{ "statistics": { "processing": [ { "name": "CAPE", "time": 1.49 }, { "name": "AnalysisInfo", "time": 0.014 }, { "name": "BehaviorAnalysis", "time": 0.508 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 1.246 }, { "name": "UrlAnalysis", "time": 1.832 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_self", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "removes_zoneid_ads", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "deletes_files", "time": 0.0 }, { "name": "drops_files", "time": 0.0 }, { "name": "reads_files", "time": 0.0 }, { "name": "writes_files", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.002 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.001 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.001 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.001 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.001 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.003 }, { "name": "antianalysis_detectreg", "time": 0.067 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.006 }, { "name": "antiav_detectreg", "time": 0.313 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.006 }, { "name": "antivm_generic_bios", "time": 0.004 }, { "name": "antivm_generic_diskreg", "time": 0.013 }, { "name": "antivm_hyperv_keys", "time": 0.006 }, { "name": "antivm_parallels_keys", "time": 0.017 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.001 }, { "name": "antivm_vbox_files", "time": 0.002 }, { "name": "antivm_vbox_keys", "time": 0.036 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.024 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.012 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.017 }, { "name": "ketrican_regkeys", "time": 0.003 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.001 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.002 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.006 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.006 }, { "name": "checks_uac_status", "time": 0.001 }, { "name": "uac_bypass_cmstpcom", "time": 0.001 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.001 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.002 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.001 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.001 }, { "name": "disables_windows_defender_logging", "time": 0.003 }, { "name": "removes_windows_defender_contextmenu", "time": 0.003 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.001 }, { "name": "discover_registry_mount_points", "time": 0.001 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.003 }, { "name": "infostealer_ftp", "time": 0.109 }, { "name": "infostealer_im", "time": 0.06 }, { "name": "infostealer_mail", "time": 0.012 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.008 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.001 }, { "name": "modify_uac_prompt", "time": 0.001 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.003 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.003 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.001 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.001 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.002 }, { "name": "ransomware_files", "time": 0.004 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.003 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.001 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.001 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.101 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.01 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.011 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "dropped": [ { "name": [ "MicrosoftEdgeUpdate.log" ], "path": "/opt/CAPEv2/storage/analyses/41/files/a9dce6cfa04718d830d0b771fec562178730bed2ef59c79fede912a7dd96fef7", "guest_paths": [ "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" ], "size": 692816, "crc32": "F1F9E20B", "md5": "dad0908995a6917d849792d55388a98a", "sha1": "1b9bf0aca537233297556fcdcf905ce87ccc594e", "sha256": "a9dce6cfa04718d830d0b771fec562178730bed2ef59c79fede912a7dd96fef7", "sha512": "5293d750abd7fcc9deb7d147583d79e7fe244d509f92ac758975798b5458caa75b6dfe7356b07d576706d401e84d140d54e6904162e1d9558a8ea7c700c2e211", "rh_hash": null, "ssdeep": "6144:BLAv7KmnoIA+JDrElR9yPJBbMLbvw0VFyFPoBKh48jMdyFPoB+MN0CbjyFPoBhe0:V", "type": "Unicode text, UTF-16, little-endian text, with very long lines (2504), with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1F8E4E62637F80659FDF7DE27E9F6DC66B97BB9A62814C44C0091068E0837B02D97472B", "sha3_384": "57b885a74423eba763cc4376e270454ab23874352db5abca1ff8ce7b5a89d8425fc512f3e4dbe7020254189b71f10ae1", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": "ÿþ[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00001\u00006\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00004\u00001\u00002\u0000:\u00002\u00004\u00001\u00006\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000]\u0000[\u0000\"\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000/\u0000s\u0000v\u0000c\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00001\u00006\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00004\u00001\u00002\u0000:\u00002\u00004\u00001\u00006\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000d\u0000l\u0000l\u0000]\u0000[\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000 \u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000[\u0000o\u0000p\u0000t\u0000]\u0000[\u0000o\u0000f\u0000f\u0000i\u0000c\u0000i\u0000a\u0000l\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00001\u00006\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00004\u00001\u00002\u0000:\u00002\u00004\u00001\u00006\u0000]\u0000[\u0000i\u0000s\u0000 \u0000m\u0000a\u0000c\u0000h\u0000i\u0000n\u0000e\u0000:\u0000 \u00001\u0000]\u0000[\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000 \u0000d\u0000i\u0000r\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00006\u00003\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00004\u00001\u00002\u0000:\u00002\u00006\u00001\u00002\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00006\u00003\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00004\u00001\u00002\u0000:\u00002\u00004\u00001\u00006\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000 \u0000e\u0000x\u0000i\u0000t\u0000]\u0000[\u00000\u0000x\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00007\u00008\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000]\u0000[\u0000\"\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000/\u0000c\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00007\u00008\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000d\u0000l\u0000l\u0000]\u0000[\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000 \u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000[\u0000o\u0000p\u0000t\u0000]\u0000[\u0000o\u0000f\u0000f\u0000i\u0000c\u0000i\u0000a\u0000l\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00006\u00007\u00008\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000i\u0000s\u0000 \u0000m\u0000a\u0000c\u0000h\u0000i\u0000n\u0000e\u0000:\u0000 \u00001\u0000]\u0000[\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000 \u0000d\u0000i\u0000r\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00007\u00002\u00005\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000C\u0000O\u0000M\u0000]\u0000[\u00003\u00002\u0000-\u0000b\u0000i\u0000t\u0000 \u0000p\u0000r\u0000o\u0000x\u0000y\u0000 \u0000f\u0000o\u0000r\u0000 \u0000I\u0000I\u0000D\u0000 \u0000{\u00001\u00009\u00005\u0000A\u00002\u0000E\u0000B\u00003\u0000-\u00002\u00001\u0000E\u0000E\u0000-\u00004\u00003\u0000C\u0000A\u0000-\u00009\u0000F\u00002\u00003\u0000-\u00009\u00003\u0000C\u00002\u0000C\u00009\u00009\u00003\u00004\u0000E\u00002\u0000E\u0000}\u0000 \u0000i\u0000n\u0000v\u0000a\u0000l\u0000i\u0000d\u0000.\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00002\u0000.\u00008\u00009\u00007\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000C\u0000O\u0000M\u0000 \u0000r\u0000e\u0000g\u0000i\u0000s\u0000t\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000 \u0000i\u0000s\u0000 \u0000n\u0000o\u0000t\u0000 \u0000v\u0000a\u0000l\u0000i\u0000d\u0000]\u0000[\u0000i\u0000s\u0000_\u0000m\u0000a\u0000c\u0000h\u0000i\u0000n\u0000e\u0000:\u0000 \u00001\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00003\u0000.\u00003\u00005\u00001\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00003\u0000.\u00003\u00006\u00006\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000]\u0000[\u0000\"\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000/\u0000r\u0000e\u0000g\u0000s\u0000e\u0000r\u0000v\u0000e\u0000r\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00004\u0000.\u00001\u00009\u00004\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000d\u0000l\u0000l\u0000]\u0000[\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000 \u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000[\u0000o\u0000p\u0000t\u0000]\u0000[\u0000o\u0000f\u0000f\u0000i\u0000c\u0000i\u0000a\u0000l\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00004\u0000.\u00003\u00008\u00002\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000i\u0000s\u0000 \u0000m\u0000a\u0000c\u0000h\u0000i\u0000n\u0000e\u0000:\u0000 \u00001\u0000]\u0000[\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000 \u0000d\u0000i\u0000r\u0000]\u0000[\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u00001\u0000.\u00003\u0000.\u00001\u00004\u00007\u0000.\u00003\u00007\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00005\u0000.\u00005\u00005\u00004\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00004\u00001\u00006\u00008\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00007\u0000.\u00008\u00005\u00001\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00004\u00003\u00003\u00006\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00007\u0000.\u00009\u00009\u00001\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00004\u00004\u00002\u00008\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00008\u0000.\u00000\u00003\u00008\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00001\u00007\u00003\u00002\u0000:\u00001\u00007\u00007\u00006\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000 \u0000e\u0000x\u0000i\u0000t\u0000]\u0000[\u00000\u0000x\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00008\u0000.\u00000\u00006\u00009\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000C\u0000O\u0000M\u0000 \u0000r\u0000e\u0000g\u0000i\u0000s\u0000t\u0000r\u0000a\u0000t\u0000i\u0000o\u0000n\u0000 \u0000r\u0000e\u0000p\u0000a\u0000i\u0000r\u0000e\u0000d\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00008\u0000.\u00002\u00007\u00002\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000F\u0000i\u0000n\u0000i\u0000s\u0000h\u0000I\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000I\u0000f\u0000N\u0000e\u0000e\u0000d\u0000e\u0000d\u0000]\u0000[\u0000I\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000 \u0000m\u0000i\u0000s\u0000s\u0000i\u0000n\u0000g\u0000 \u0000s\u0000c\u0000h\u0000e\u0000d\u0000u\u0000l\u0000e\u0000 \u0000t\u0000a\u0000s\u0000k\u0000s\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00008\u0000.\u00005\u00005\u00004\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000A\u0000p\u0000p\u0000C\u0000o\u0000m\u0000m\u0000a\u0000n\u0000d\u0000:\u0000:\u0000E\u0000x\u0000e\u0000c\u0000u\u0000t\u0000e\u0000]\u0000[\u0000L\u0000a\u0000u\u0000n\u0000c\u0000h\u0000F\u0000i\u0000n\u0000i\u0000s\u0000h\u0000I\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000A\u0000p\u0000p\u0000C\u0000o\u0000m\u0000m\u0000a\u0000n\u0000d\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00009\u0000.\u00002\u00005\u00007\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000S\u0000t\u0000a\u0000r\u0000t\u0000e\u0000d\u0000 \u0000p\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000]\u0000[\u00004\u00005\u00000\u00004\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00009\u0000.\u00002\u00007\u00002\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00002\u00006\u00006\u00000\u0000:\u00002\u00006\u00006\u00004\u0000]\u0000[\u0000A\u0000p\u0000p\u0000C\u0000o\u0000m\u0000m\u0000a\u0000n\u0000d\u0000:\u0000:\u0000E\u0000x\u0000e\u0000c\u0000u\u0000t\u0000e\u0000 \u0000e\u0000x\u0000e\u0000c\u0000u\u0000t\u0000e\u0000d\u0000]\u0000[\u0000{\u00005\u00006\u0000E\u0000B\u00001\u00008\u0000F\u00008\u0000-\u0000B\u00000\u00000\u00008\u0000-\u00004\u0000C\u0000B\u0000D\u0000-\u0000B\u00006\u0000D\u00002\u0000-\u00008\u0000C\u00009\u00007\u0000F\u0000E\u00007\u0000E\u00009\u00000\u00006\u00002\u0000}\u0000]\u0000[\u00001\u0000]\u0000[\u0000o\u0000n\u0000-\u0000f\u0000i\u0000n\u0000i\u0000s\u0000h\u0000-\u0000i\u0000n\u0000s\u0000t\u0000a\u0000l\u0000l\u0000]\u0000[\u0000H\u0000R\u0000E\u0000S\u0000U\u0000L\u0000T\u0000=\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000]\u0000[\u0000P\u0000I\u0000D\u0000=\u00004\u00004\u00004\u00008\u0000]\u0000[\u0000e\u0000x\u0000i\u0000t\u0000_\u0000c\u0000o\u0000d\u0000e\u0000=\u00002\u00005\u00009\u0000]\u0000\r\u0000\n\u0000[\u00000\u00005\u0000/\u00002\u00008\u0000/\u00002\u00006\u0000 \u00001\u00005\u0000:\u00002\u00004\u0000:\u00003\u00009\u0000.\u00002\u00007\u00002\u0000]\u0000[\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000:\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000u\u0000p\u0000d\u0000a\u0000t\u0000e\u0000]\u0000[\u00004\u00005\u00000\u00004\u0000:\u00004\u00005\u00000\u00008\u0000]\u0000[\u0000D\u0000l\u0000l\u0000E\u0000n\u0000t\u0000r\u0000y\u0000]\u0000[\u0000\"\u0000C\u0000:\u0000\\\u0000P\u0000r\u0000o\u0000g\u0000r\u0000a\u0000m\u0000 \u0000F\u0000i\u0000l\u0000e\u0000s\u0000 \u0000(\u0000x\u00008\u00006\u0000)\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000\\\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000/\u0000p\u0000i\u0000n\u0000g\u0000 \u0000P\u0000D\u00009\u00004\u0000b\u0000W\u0000w\u0000g\u0000d\u0000m\u0000V\u0000y\u0000c\u00002\u0000l\u0000v\u0000b\u0000j\u00000\u0000i\u0000M\u0000S\u00004\u0000w\u0000I\u0000i\u0000B\u0000l\u0000b\u0000m\u0000N\u0000v\u0000Z\u0000G\u0000l\u0000u\u0000Z\u0000z\u00000\u0000i\u0000V\u0000V\u0000R\u0000G\u0000L\u0000T\u0000g\u0000i\u0000P\u0000z\u00004\u00008\u0000c\u0000m\u0000V\u0000x\u0000d\u0000W\u0000V\u0000z\u0000d\u0000C\u0000B\u0000w\u0000c\u0000m\u00009\u00000\u0000b\u00002\u0000N\u0000v\u0000b\u0000D\u00000\u0000i\u0000M\u0000y\u00004\u0000w\u0000I\u0000i\u0000B\u00001\u0000c\u0000G\u0000R\u0000h\u0000d\u0000G\u0000V\u0000y\u0000P\u0000S\u0000J\u0000P\u0000b\u0000W\u0000F\u0000o\u0000Y\u0000S\u0000I\u0000g\u0000d\u0000X\u0000B\u0000k\u0000Y\u0000X\u0000R\u0000l\u0000c\u0000n\u0000Z\u0000l\u0000c\u0000n\u0000N\u0000p\u0000b\u00002\u00004\u00009\u0000I\u0000j\u0000E\u0000u\u0000M\u0000y\u00004\u0000x\u0000N\u0000D\u0000c\u0000u\u0000M\u0000z\u0000c\u0000i\u0000I\u0000H\u0000N\u0000o\u0000Z\u0000W\u0000x\u0000s\u0000X\u00003\u0000Z\u0000l\u0000c\u0000n\u0000N\u0000p\u0000b\u00002\u00004\u00009\u0000I\u0000j\u0000E\u0000u\u0000M\u0000y\u00004\u0000x\u0000N\u0000D\u0000c\u0000u\u0000M\u0000z\u0000c\u0000i\u0000I\u0000G\u0000l\u0000z\u0000b\u0000W\u0000F\u0000j\u0000a\u0000G\u0000l\u0000u\u0000Z\u0000T\u00000\u0000i\u0000M\u0000S\u0000I\u0000g\u0000c\u00002\u0000V\u0000z\u0000c\u00002\u0000l\u0000v\u0000b\u0000m\u0000l\u0000k\u0000P\u0000S\u0000J\u00007\u0000R\u0000k\u0000E\u00004\u0000N\u0000z\u0000Q\u0000w\u0000R\u0000j\u0000c\u0000t\u0000M\u0000j\u0000c\u0000w\u0000N\u0000S\u00000\u00000\u0000Q\u0000T\u0000I\u00005\u0000L\u0000T\u0000k\u0000y\u0000M\u0000k\u0000E\u0000t\u0000O\u0000T\u0000Q\u0000w\u0000R\u0000D\u0000B\u0000B\u0000N\u0000D\u0000F\u0000D\u0000N\u0000D\u0000I\u0000w\u0000f\u0000S\u0000I\u0000g\u0000d\u0000X\u0000N\u0000l\u0000c\u0000m\u0000l\u0000k\u0000P\u0000S\u0000J\u00007\u0000R\u0000k\u0000Y\u00003\u0000R\u0000T\u0000Q\u00000\u0000Q\u0000U\u0000I\u0000t\u0000M\u0000T\u0000g\u0000y\u0000Q\u0000y\u00000\u00000\u0000M\u0000j\u0000M\u00003\u0000L\u0000T\u0000g\u0000w\u0000R\u0000E\u0000I\u0000t\u0000R\u0000j\u0000U\u00004\u0000M\u0000j\u0000Y\u0000w\u0000O\u0000T\u0000k\u0000z\u0000N\u0000z\u0000E\u00002\u0000f\u0000S\u0000I\u0000g\u0000c\u0000m\u0000V\u0000x\u0000d\u0000W\u0000V\u0000z\u0000d\u0000G\u0000l\u0000k\u0000P\u0000S\u0000J\u00007\u0000N\u0000z\u0000F\u0000E\u0000Q\u0000z\u0000U\u0000z\u0000Q\u0000j\u0000Q\u0000t\u0000N\u0000k\u0000J\u0000F\u0000M\u0000S\u00000\u00000\u0000Q\u0000U\u0000Q\u0000y\u0000L\u0000T\u0000k\u0000z\u0000R\u0000T\u0000M\u0000t\u0000M\u0000T\u0000E\u00005\u0000O\u0000U\u0000Y\u00001\u0000N\u0000T\u0000M\u0000z\u0000Q\u0000j\u0000J\u0000D\u0000f\u0000S\u0000I\u0000g\u0000Z\u0000G\u0000V\u0000k\u0000d\u0000X\u0000A\u00009\u0000I\u0000m\u0000N\u0000y\u0000I\u0000i\u0000B\u0000k\u0000b\u00002\u00001\u0000h\u0000a\u0000W\u00005\u0000q\u0000b\u00002\u0000l\u0000u\u0000Z\u0000W\u0000Q\u00009\u0000I\u0000j\u0000A\u0000i\u0000P\u0000j\u0000x\u0000o\u0000d\u0000y\u0000B\u0000s\u0000b\u00002\u0000d\u0000p\u0000Y\u00002\u0000F\u0000s\u0000X\u00002\u0000N\u0000w\u0000d\u0000X\u0000M\u00009\u0000I\u0000j\u0000I\u0000i\u0000I\u0000H\u0000B\u0000o\u0000e\u0000X\u0000N\u0000t\u0000Z\u0000W\u00001\u0000v\u0000c\u0000n\u0000k\u00009\u0000I\u0000j\u0000Q\u0000i\u0000I\u0000G\u0000R\u0000p\u0000c\u00002\u0000t\u0000f\u0000d\u0000H\u0000l\u0000w\u0000Z\u0000T\u00000\u0000i\u0000M\u0000i\u0000I\u0000g\u0000c\u00003\u0000N\u0000l\u0000P\u0000S\u0000I\u0000x\u0000I\u0000i\u0000B\u0000z\u0000c\u00002\u0000U\u0000y\u0000P\u0000S\u0000I\u0000x\u0000I\u0000i\u0000B\u0000z\u0000c\u00002\u0000U\u0000z\u0000P\u0000S\u0000I\u0000x\u0000I\u0000i\u0000B\u0000z\u0000c\u00003\u0000N\u0000l\u0000M\u0000z\u00000\u0000i\u0000M\u0000S\u0000I\u0000g\u0000c\u00003\u0000N\u0000l\u0000N\u0000D\u0000E\u00009\u0000I\u0000j\u0000E\u0000i\u0000I\u0000H\u0000N\u0000z\u0000Z\u0000T\u0000Q\u0000y\u0000P\u0000S\u0000I\u0000x\u0000I\u0000i\u0000B\u0000h\u0000d\u0000n\u0000g\u00009\u0000I\u0000j\u0000E\u0000i\u0000L\u0000z\u00004\u00008\u0000b\u00003\u0000M\u0000g\u0000c\u0000G\u0000x\u0000h\u0000d\u0000G\u0000Z\u0000v\u0000c\u0000m\u00000\u00009\u0000I\u0000n\u0000d\u0000p\u0000b\u0000i\u0000I\u0000g\u0000d\u0000m\u0000V\u0000y\u0000c\u00002\u0000l\u0000v\u0000b\u0000j\u00000\u0000i\u0000M\u0000T\u0000A\u0000u\u0000M\u0000C\u00004\u0000x\u0000O\u0000T\u0000A\u00000\u0000N\u0000S\u00004\u0000z\u0000O\u0000D\u0000A\u0000z\u0000I\u0000i\u0000B\u0000z\u0000c\u0000D\u00000\u0000i\u0000I\u0000i\u0000B\u0000h\u0000c\u0000m\u0000N\u0000o\u0000P\u0000S\u0000J\u00004\u0000N\u0000j\u0000Q\u0000i\u0000L\u0000z\u00004\u00008\u0000b\u00002\u0000V\u0000t\u0000I\u0000H\u0000B\u0000y\u0000b\u00002\u0000R\u00001\u0000Y\u00003\u0000R\u0000f\u0000b\u0000W\u0000F\u0000u\u0000d\u0000W\u0000Z\u0000h\u0000Y\u00003\u0000R\u00001\u0000c\u0000m\u0000V\u0000y\u0000P\u0000S\u0000I\u0000i\u0000I\u0000H\u0000B\u0000y\u0000b\u00002\u0000R\u00001\u0000Y\u00003\u0000R\u0000f\u0000b\u0000m\u0000F\u0000t\u0000Z\u0000T\u00000\u0000i\u0000I\u0000i\u00008\u0000-\u0000P\u0000G\u0000V\u00004\u0000c\u0000C\u0000B\u0000l\u0000d\u0000G\u0000F\u0000n\u0000P\u0000S\u0000I\u0000i\u0000L\u0000z\u00004\u00008\u0000Y\u0000X\u0000B\u0000w\u0000I\u0000G\u0000F\u0000w\u0000c\u0000G\u0000l\u0000k\u0000P\u0000S\u0000J\u00007\u0000N\u0000T\u0000Z\u0000F\u0000Q\u0000j\u0000E\u00004\u0000R\u0000j\u0000g\u0000t\u0000Q\u0000j\u0000A\u0000w\u0000O\u0000C\u00000\u00000\u0000Q\u00000\u0000J\u0000E\u0000L\u0000U\u0000I\u00002\u0000R\u0000D\u0000I\u0000t\u0000O\u0000E\u0000M\u00005\u0000N\u00000\u0000Z\u0000F\u0000N\u00000\u0000U\u00005\u0000M\u0000D\u0000Y\u0000y\u0000f\u0000S\u0000I\u0000g\u0000d\u0000m\u0000V\u0000y\u0000c\u00002\u0000l\u0000v\u0000b\u0000j\u00000\u0000i\u0000O\u0000T\u0000I\u0000u\u0000M\u0000C\u00004\u00005\u0000M\u0000D\u0000I\u0000u\u0000N\u0000j\u0000c\u0000i\u0000I\u0000G\u00005\u0000l\u0000e\u0000H\u0000R\u00002\u0000Z\u0000X\u0000J\u0000z\u0000a\u0000W\u00009\u0000u\u0000P\u0000S\u0000I\u0000i\u0000I\u0000G\u0000x\u0000h\u0000b\u0000m\u0000c\u00009\u0000I\u0000i\u0000I\u0000g\u0000Y\u0000n\u0000J\u0000h\u0000b\u0000m\u0000Q\u00009\u0000I\u0000k\u0000l\u0000O\u0000Q\u0000l\u0000g\u0000i\u0000I\u0000G\u0000N\u0000s\u0000a\u0000W\u0000V\u0000u\u0000d\u0000D\u00000\u0000i\u0000I\u0000j\u0000 ", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": "11132,5932" } ], "CAPE": { "payloads": [ { "name": "760e3c46aa0d294ae0c9528bdd5ad0e57b0e0a20301b2e3a7ca6bd400b7ee76a", "path": "/opt/CAPEv2/storage/analyses/41/CAPE/760e3c46aa0d294ae0c9528bdd5ad0e57b0e0a20301b2e3a7ca6bd400b7ee76a", "guest_paths": "9;?C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe;?C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe;?0x023D0000;?", "size": 295, "crc32": "7C060E3A", "md5": "189a9c3a742a266df1481495895b8654", "sha1": "4ef2e4cf36f722e44ad143433167de8e30ea3e2b", "sha256": "760e3c46aa0d294ae0c9528bdd5ad0e57b0e0a20301b2e3a7ca6bd400b7ee76a", "sha512": "a8a3f170dcdf45aeba2b0edae07de4fec51f22ef5636013d2ec5005bd60a0f2f8877bbda898ff8c0798e7b28bfcfe1e8be442f6833a216c03e640991b0cdff87", "rh_hash": null, "ssdeep": "6:oKCmBFf1bLNQvZqzwOVkWOkshycFGhdvKZEBxDugyI7qw+GIfDJ:oKLD1/NQv8tkBvCX5IV", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T100E07D1320226573826111BDE8293AC4C1130497074D14F39450393D95135E346F51E5", "sha3_384": "24f53d17b495e34382bca2b485920fe54057629626e3a45f4f044b6cdb9c72e17fc4efacfe17178e0f42e9deb0b73d4a", "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe", "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10", "data": null, "strings": [ "C:\\lpw_albt\\dll\\nxatNo.dll", "u#h D" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "process_name": "MicrosoftEdgeUpdate.exe", "module_path": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "pid": 5932, "virtual_address": "0x023D0000" } ], "configs": [] }, "info": { "version": "2.5", "started": "2026-05-29 06:44:05", "ended": "2026-05-29 06:47:47", "duration": 222, "id": 41, "category": "url", "custom": "", "machine": { "id": 37, "status": "stopping", "name": "cuckoo1", "label": "cuckoo1", "platform": "windows", "manager": "KVM", "started_on": "2026-05-29 06:44:05", "shutdown_on": "2026-05-29 06:47:46" }, "package": "edge", "timeout": true, "tlp": null, "parent_sample": null, "options": { "interactive": "1", "nohuman": "yes", "vnc_port": "5910" }, "source_url": null, "route": "none", "user_id": 1, "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2" }, "behavior": { "processes": [ { "process_id": 4484, "process_name": "explorer.exe", "parent_id": 4364, "module_path": "C:\\Windows\\explorer.exe", "first_seen": "2026-05-29 10:44:12,579", "calls": [ { "timestamp": "2026-05-29 10:44:12,751", "thread_id": "6148", "caller": "0x7fff59926aa3", "parentcaller": "0x7fff59fb2dc9", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4968" }, { "name": "ThreadHandle", "value": "0x000022f8" }, { "name": "ApcRoutine", "value": "0x7fff5992ded0" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:44:13,110", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000cbc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:44:13,110", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000cbc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 2 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000263c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 5 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000263c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000263c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000263c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000263c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 8 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000da0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002638" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 11 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000da0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000da0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000da0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000da0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 14 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 18 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 20 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 22 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 27 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 40 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 42 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 44 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 49 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 56 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 58 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 60 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 65 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:44:13,126", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001124" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 99 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 101 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 103 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 108 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 115 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 117 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 119 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 124 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 137 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 139 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 141 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 146 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 153 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 155 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 157 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 162 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 175 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 177 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 179 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 184 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d18" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d18" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d18" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 190 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d5c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000010fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d5c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d5c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 193 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000010fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000010fc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000b68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000010fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000010fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 196 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 200 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 202 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 204 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:44:13,141", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 209 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 222 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 224 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 226 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 231 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 238 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 240 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 242 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 247 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 268 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 270 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 272 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 277 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 284 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 286 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 288 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 293 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 306 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 308 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 310 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 315 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 322 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 324 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 326 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 331 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 344 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 346 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 348 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 353 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:44:13,157", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000b68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000b68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 359 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ad8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ad8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a88" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001970" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d7c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000db4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d70" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000c30" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d00" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ee4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000edc" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eb8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001190" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021f0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002110" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001780" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001780" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 378 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002110" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002110" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002110" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002110" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 381 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d5c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d5c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000254c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000254c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 386 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d18" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d18" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:44:13,172", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 391 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001124" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001124" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 394 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ed4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ee0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 397 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ed4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ed4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ed0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ed4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ed4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 400 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ed0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ed0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ebc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ed0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ed0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 403 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ebc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ebc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001794" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ebc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ebc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 406 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 410 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 412 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 414 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 419 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 432 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 434 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 436 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:44:13,188", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 441 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 448 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 450 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 452 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 457 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 478 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 480 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 482 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 487 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 494 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 496 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 498 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 503 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 516 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 518 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 520 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 525 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 532 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 534 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 536 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 541 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 554 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 556 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 558 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 563 }, { "timestamp": "2026-05-29 10:44:13,266", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001794" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001794" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ebc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ebc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 569 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ec8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 572 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ec4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 575 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 579 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 581 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 583 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 588 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 601 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 603 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 605 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 610 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 617 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 619 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 621 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 626 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 647 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 649 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 651 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 656 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 663 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 665 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 667 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 672 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 685 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:44:13,282", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 687 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 689 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 694 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 701 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 703 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 705 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 710 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4cd912f2", "parentcaller": "0x7fff4cd9109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4cd8c333", "parentcaller": "0x7fff4cd89609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 723 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 725 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 727 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b075ed6", "parentcaller": "0x7fff4b074fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4cd8c375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 732 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff4b0760d1", "parentcaller": "0x7fff4b076111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff55825882", "parentcaller": "0x7fff55824474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ec0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001794" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ec0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ec0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 738 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001794" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001794" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001794" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ec8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ed0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ee0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000dac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001068" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000b10" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026a4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000269c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002694" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002688" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000267c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002990" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002678" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002710" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000263c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002994" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002994" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 757 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000263c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000263c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ac0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000263c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000263c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 760 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ac0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ac0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ac0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:44:13,297", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a10" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a10" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 765 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ab0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000eb0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eb0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 770 }, { "timestamp": "2026-05-29 10:44:13,313", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a18" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000eb8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eb8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 773 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002638" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 776 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000eb0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000eb0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eb0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 779 }, { "timestamp": "2026-05-29 10:44:13,344", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 782 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f0c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ea0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 785 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ea0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ea0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f14" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ea0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ea0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 788 }, { "timestamp": "2026-05-29 10:44:13,360", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f14" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f14" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:44:13,391", "thread_id": "4696", "caller": "0x7ff79bd27be7", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:44:13,407", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:44:13,407", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 792 }, { "timestamp": "2026-05-29 10:44:13,407", "thread_id": "4696", "caller": "0x7ff79bd27e2d", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:44:13,407", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:44:13,407", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 795 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc4d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc1e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca64000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x076d6000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b72000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd27be7", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 803 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ce4a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd27e2d", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 807 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x076c2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08bdc000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0c80a000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x076ca000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bb1b000" }, { "name": "RegionSize", "value": "0x000c7000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bcaa000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "2440", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cf7d000" }, { "name": "RegionSize", "value": "0x000c7000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "5100", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d30a000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "5100", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f6f120", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d308000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4840", "caller": "0x7fff59f5e46f", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x14e80000" }, { "name": "RegionSize", "value": "0x00fd0000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "4840", "caller": "0x7fff59f5e4f0", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x14e80000" }, { "name": "RegionSize", "value": "0x000ca000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:44:13,422", "thread_id": "5096", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x14f4a000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:44:14,360", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f0c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a90" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caa4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "yes" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f0c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "4840", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a90" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "4840", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5108", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a8c" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\PenWorkspace\\DiscoverCacheData.dat" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "2", "pretty_value": "FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ef0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000ef0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b4b0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "6220" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000ef0" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "6220" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6220", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a7c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6220", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000edc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 836 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "7840", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:44:14,376", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 843 }, { "timestamp": "2026-05-29 10:44:14,391", "thread_id": "4744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 844 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000297c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ef4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ef4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 846 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000297c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000297c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000297c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000297c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 849 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ee4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 852 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 855 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ee8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ee8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ee8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 858 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a6c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002524" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a6c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 861 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002524" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002524" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002524" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002524" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 864 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021f0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021e0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021f0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 867 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000021e0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021e0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001190" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 870 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001190" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001190" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001190" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001190" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 873 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a74" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001a08" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a74" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a74" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 876 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001a08" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001a08" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a64" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001a08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001a08" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 879 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a64" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a64" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a64" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a64" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 882 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d00" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d00" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d00" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 885 }, { "timestamp": "2026-05-29 10:44:15,782", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5000", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "4696", "caller": "0x7ff79bc7b354", "parentcaller": "0x7ff79bc7b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "6220", "caller": "0x7ff79bc3ca89", "parentcaller": "0x7ff79bc3c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d00" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "6220", "caller": "0x7ff79bc3c67f", "parentcaller": "0x7ff79bc3c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a64" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add50000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000eb8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5100", "caller": "0x7ff79bc799ca", "parentcaller": "0x7ff79bc7a869", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5100", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a9c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5100", "caller": "0x7ff79bc7bdd2", "parentcaller": "0x7ff79bc7a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a9c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "6220", "caller": "0x7ff79bc3a878", "parentcaller": "0x7ff79bc3a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4add50000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "5100", "caller": "0x7ff79bc7a552", "parentcaller": "0x7ff79bc79a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:44:22,547", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "4696", "caller": "0x7ff79bc7c9d8", "parentcaller": "0x7ff79bc7c92d", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002a64", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8b750" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "5952" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "4696", "caller": "0x7ff79bc7c9d8", "parentcaller": "0x7ff79bc7c92d", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002a64" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5952" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "5952", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "5952", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002638" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f80000" }, { "name": "SectionOffset", "value": "0x09a7d690" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "5952", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "5952", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e76281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "6096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d6c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "6096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000db4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f90000" }, { "name": "SectionOffset", "value": "0x02f2d330" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:44:22,563", "thread_id": "5952", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5286bde6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 909 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 910 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076a9538" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076a9b98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f80000" }, { "name": "SectionOffset", "value": "0x09a7e9b0" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a64" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000025b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022f8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001a08" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a600000" }, { "name": "SectionOffset", "value": "0x09a7e930" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f9c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f98" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002a78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f90000" }, { "name": "SectionOffset", "value": "0x02f2e650" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000c30" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000195c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:44:22,579", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f98" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000195c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d520000" }, { "name": "SectionOffset", "value": "0x02f2e5d0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000195c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000c30" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aa0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00001f9c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f9c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 10:44:22,594", "thread_id": "6096", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 10:44:22,610", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f0c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 10:44:23,876", "thread_id": "5096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 943 }, { "timestamp": "2026-05-29 10:44:23,876", "thread_id": "4668", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 10:44:23,876", "thread_id": "4668", "caller": "0x7fff409a8258", "parentcaller": "0x7fff409a88d7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x033af220" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "4772", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "4668", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f9c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x033aefc0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001140" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "5096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0354d8a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "5096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "6148", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f9c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 10:44:23,891", "thread_id": "5096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 10:44:24,344", "thread_id": "5096", "caller": "0x7fff59926aa3", "parentcaller": "0x7fff59fb2dc9", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "6212" }, { "name": "ThreadHandle", "value": "0x00001b88" }, { "name": "ApcRoutine", "value": "0x7fff5992ded0" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 10:44:24,454", "thread_id": "4840", "caller": "0x7fff59926aa3", "parentcaller": "0x7fff59fb2dc9", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4968" }, { "name": "ThreadHandle", "value": "0x00001ab4" }, { "name": "ApcRoutine", "value": "0x7fff5992ded0" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 10:44:24,501", "thread_id": "4840", "caller": "0x7fff59926aa3", "parentcaller": "0x7fff59fb2dc9", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "6204" }, { "name": "ThreadHandle", "value": "0x00001ccc" }, { "name": "ApcRoutine", "value": "0x7fff5992ded0" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 10:44:27,454", "thread_id": "4840", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000017d8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f88" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f88" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f190" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 959 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002638" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e58" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e58" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e58" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 10:44:27,579", "thread_id": "4720", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9d281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ab4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x07fcd7a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "4840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "5096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000017d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0354efc0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "5096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000017d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "5096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CCC63AE1-56A5-4F9C-ABE8-E55674F0C0A6" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DA620430-5F6C-447D-8091-C5757E275B37" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 10:44:27,688", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5809319a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7BCE3CFB-954C-438F-974C-73A8E0593F1A" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 10:44:27,704", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 10:44:27,704", "thread_id": "5952", "caller": "0x7fff5573083e", "parentcaller": "0x7fff5573072b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 10:44:27,751", "thread_id": "5096", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f76068", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caeb000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 10:44:27,751", "thread_id": "5096", "caller": "0x7fff57fc4db6", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001838" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\Windows\\System32\\twinui.pcshell.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 10:44:27,751", "thread_id": "5096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff426e22b4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x7fff44d50000" } ], "repeated": 1, "id": 987 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "5000", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ccdd000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "5096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002550" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002550" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fd0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 991 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002638" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002638" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "6252", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 993 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "7840", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 10:44:31,438", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 10:44:32,797", "thread_id": "5100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010fc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "5100", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 998 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e80" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001140" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "5100", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 10:44:38,891", "thread_id": "5100", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000010fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aac" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002088" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5100", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5100", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001aac" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027e4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5000", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000027e4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8af70" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "5228" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5000", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000027e4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5228" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "5228", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "6220", "caller": "0x7fff577f3013", "parentcaller": "0x7fff41e0672b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001520" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1016 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4744", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4744", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4744", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "4744", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 10:44:39,688", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1022 }, { "timestamp": "2026-05-29 10:44:39,719", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 10:44:39,719", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 10:44:39,751", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 10:44:39,751", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 10:44:39,766", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 10:44:39,766", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 10:44:39,797", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 10:44:39,797", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5100", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5100", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5000", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca9b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ea8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001270" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1041 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "7840", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "7840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "7840", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "7840", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 10:44:39,829", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 10:44:39,844", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1048 }, { "timestamp": "2026-05-29 10:44:39,844", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 10:44:39,844", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 10:44:39,876", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 10:44:39,876", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 10:44:39,891", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 10:44:39,891", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 10:44:39,922", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 10:44:39,922", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 10:44:39,954", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-29 10:44:39,954", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "5100", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "5100", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1063 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "7840", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "7840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "7840", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "7840", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 10:44:41,110", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1070 }, { "timestamp": "2026-05-29 10:44:41,219", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 10:44:41,219", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 10:44:44,751", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 10:44:44,751", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f88" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 10:44:44,751", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002088" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 10:44:44,751", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000170c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 10:44:44,751", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 10:44:44,766", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1078 }, { "timestamp": "2026-05-29 10:44:44,829", "thread_id": "4840", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000012b4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ee4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d6c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5108", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff57815984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5100", "caller": "0x7ff79bc79d10", "parentcaller": "0x7ff79bc79c74", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5100", "caller": "0x7ff79bc79d60", "parentcaller": "0x7ff79bc79c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 10:44:45,126", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e68" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "5000", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff41dbd62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001c8c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "6252", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1087 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "4744", "caller": "0x7fff40c74428", "parentcaller": "0x7fff40c73a03", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F0AE1542-F497-484B-A175-A20DB09144BA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8DC24A1A-6314-4769-9D68-179786F4CED6" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "6252", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff557c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "4744", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "4744", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "4744", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 10:44:45,141", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 1094 }, { "timestamp": "2026-05-29 10:44:47,126", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002638" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Volume{528C102F-0000-0000-0000-300300000000}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 10:44:47,126", "thread_id": "4720", "caller": "0x7fff5781a1e7", "parentcaller": "0x7fff55ba7d5b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e98" }, { "name": "DesiredAccess", "value": "0x00100180", "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\HarddiskVolume2\\\\xe68\\x02" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 10:44:47,126", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002550" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f7c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\services.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f7c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\services.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779d7c0" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59fba871", "parentcaller": "0x7fff577cad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "RegionSize", "value": "0x00005000" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff577cbfbf", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "RegionSize", "value": "0x000b0000" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f7c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\services.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000022cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f7c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\services.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779d7b0" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff59fba871", "parentcaller": "0x7fff577cad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "RegionSize", "value": "0x00005000" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff577cb638", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "RegionSize", "value": "0x000b0000" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff55ba84d2", "parentcaller": "0x7fff55ba872e", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F324E4F9-8496-40B2-A1FF-9617C1C9AFFE" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "387FDB83-DD33-4995-9D2D-1F647E846705" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "4720", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 10:44:47,141", "thread_id": "7840", "caller": "0x7fff55bc1487", "parentcaller": "0x7fff55bbe840", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "B52D54BB-4818-4EB9-AA80-F9EACD371DF8" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "993ECEB0-6F1B-49FE-8BA2-21B6A5317DE1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 10:44:47,157", "thread_id": "4720", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 10:44:48,297", "thread_id": "4720", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 10:44:48,297", "thread_id": "4720", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 10:44:51,954", "thread_id": "5000", "caller": "0x7fff41dbd59f", "parentcaller": "0x7fff41dfc80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001edc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 10:44:56,360", "thread_id": "5100", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "5100", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ae4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x090fd2e0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "5100", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "6096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x02f2ecc0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "6096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ee4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "6096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CCC63AE1-56A5-4F9C-ABE8-E55674F0C0A6" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DA620430-5F6C-447D-8091-C5757E275B37" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 10:44:56,376", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5809319a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7BCE3CFB-954C-438F-974C-73A8E0593F1A" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 10:44:56,391", "thread_id": "5952", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 10:44:56,391", "thread_id": "5952", "caller": "0x7fff5573083e", "parentcaller": "0x7fff5573072b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 10:44:56,969", "thread_id": "6096", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001adc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 10:45:03,735", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1129 }, { "timestamp": "2026-05-29 10:45:03,735", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001e98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 10:45:03,735", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000027dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 10:45:03,735", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 10:45:19,422", "thread_id": "4696", "caller": "0x7ff79bd27be7", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ea0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 10:45:19,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ea0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 10:45:19,422", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ea0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1135 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd27e2d", "parentcaller": "0x7ff79bd24fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2c53a", "parentcaller": "0x7ff79bd27e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1138 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ce40000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0caca000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb9f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 10:45:19,438", "thread_id": "4696", "caller": "0x7ff79bd2de16", "parentcaller": "0x7ff79bd2c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ca8a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4696", "caller": "0x7ff79bc8984c", "parentcaller": "0x7ff79bc897dc", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f0c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000da8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "2440", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15013000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4340", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x150dc000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4672", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x151a5000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4580", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1526e000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4672", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cef9000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4576", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15337000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4500", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15400000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4664", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x154c9000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "3424", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15592000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "5220", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1565b000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4812", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15724000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "6096", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0c9f6000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4344", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x157ed000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4740", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x158b6000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1597f000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "4956", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15a48000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 10:45:19,454", "thread_id": "6160", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15b11000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 10:45:20,172", "thread_id": "11812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1163 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002550" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "5596", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "5596", "caller": "0x7fff11e12b87", "parentcaller": "0x7fff11e11dea", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D6B0D1EB-456E-48FF-A3E3-F393C74B85DB" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "DBDB628F-AEEE-4630-9FEC-4256620CDB8D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1169 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ea0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 10:45:20,797", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1173 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ea0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1177 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001adc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc5652c", "parentcaller": "0x7ff79bc55d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1181 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001adc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 10:45:20,813", "thread_id": "4696", "caller": "0x7ff79bc623a8", "parentcaller": "0x7ff79bc62e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4e0bb", "parentcaller": "0x7ff79be4cb22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "D3D10Warp.dll" }, { "name": "BaseAddress", "value": "0x7fff4faa0000" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 1, "id": 1187 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d3d10warp.dll" }, { "name": "BaseAddress", "value": "0x7fff4faa0000" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ccb4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 10:45:21,032", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f08" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\d3d10warp.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb2f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5596", "caller": "0x7fff11e12b87", "parentcaller": "0x7fff11e11dea", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D6B0D1EB-456E-48FF-A3E3-F393C74B85DB" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "DBDB628F-AEEE-4630-9FEC-4256620CDB8D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\seguisb.ttf" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09440000" }, { "name": "SectionOffset", "value": "0x09a7e1c0" }, { "name": "ViewSize", "value": "0x000ee000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae131000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09010000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09020000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 10:45:21,047", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12160", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae121000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79be4cc6c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4e0bb", "parentcaller": "0x7ff79be4cb22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "D3D10Warp.dll" }, { "name": "BaseAddress", "value": "0x7fff4faa0000" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 1, "id": 1212 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d3d10warp.dll" }, { "name": "BaseAddress", "value": "0x7fff4faa0000" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4cfa3", "parentcaller": "0x7ff79be18ae9", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\d3d10warp.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae130000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae131000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79be4d26c", "parentcaller": "0x7ff79be18ae9", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09020000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09030000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae120000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "12188", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4fde9f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4ae121000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 10:45:21,063", "thread_id": "5952", "caller": "0x7ff79bc1afc1", "parentcaller": "0x7ff79be4cc6c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "6160", "caller": "0x7fff425d6afa", "parentcaller": "0x7fff42a19965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "7840", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002768", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8c2b0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "12200" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "7840", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002768" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "12200" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "7840", "caller": "0x7fff46713ec2", "parentcaller": "0x7fff584cb8f1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6C3EE638-B588-4D7D-B30A-E7E36759305D" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-29 10:45:21,079", "thread_id": "7840", "caller": "0x7fff425c54ef", "parentcaller": "0x7fff425c5361", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "45BA127D-10A8-46EA-8AB7-56EA9078943C" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "54E4C428-D1D4-47D4-ADE6-46C829114A7D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 10:45:21,110", "thread_id": "6160", "caller": "0x7fff58519794", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-29 10:45:21,110", "thread_id": "6160", "caller": "0x7fff585192b9", "parentcaller": "0x7fff584e8db3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 10:45:21,110", "thread_id": "11812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002738" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 10:45:21,797", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 10:45:21,813", "thread_id": "5596", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 10:45:21,813", "thread_id": "5596", "caller": "0x7fff41e0dfad", "parentcaller": "0x7fff41dea59b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0C9281F9-6DA1-4006-8729-DE6E6B61581C" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "DF8E9480-CA73-448E-B8F0-DA000F581428" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-29 10:45:22,282", "thread_id": "5596", "caller": "0x7fff59926aa3", "parentcaller": "0x7fff59fb2dc9", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "4484" }, { "name": "ThreadId", "value": "4968" }, { "name": "ThreadHandle", "value": "0x00002a78" }, { "name": "ApcRoutine", "value": "0x7fff5992ded0" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 10:45:23,641", "thread_id": "4580", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001e98" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 10:45:23,641", "thread_id": "4580", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1245 }, { "timestamp": "2026-05-29 10:45:23,672", "thread_id": "4956", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001aac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 10:45:23,672", "thread_id": "2440", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000012b4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 10:45:23,672", "thread_id": "4956", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1248 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "5952", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "5952", "caller": "0x7fff55825882", "parentcaller": "0x7fff55828f55", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "5952", "caller": "0x7fff44bb58e1", "parentcaller": "0x7fff44bb5ef1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1253 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "4580", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cb15000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff44bc5d4a", "parentcaller": "0x7fff44bc618f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DBCE7E40-7345-439D-B12C-114A11819A09" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "4580", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cd59000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002730" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fe0000" }, { "name": "SectionOffset", "value": "0x0982e630" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bc84000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cbd0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff577cfacc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002730" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\pris\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff577cfacc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002730" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\rescache\\_merged\\2716907977\\3245838983.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002978" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ff0000" }, { "name": "SectionOffset", "value": "0x0982e4f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577cfcb5", "parentcaller": "0x7fff577cfacc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\pris\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\pris\\resources.en-US.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001e58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "SectionOffset", "value": "0x0982e320" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-29 10:45:23,688", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1271 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "5952", "caller": "0x7fff58c2c304", "parentcaller": "0x7fff44c012c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100ac" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "5952", "caller": "0x7fff57fcb8ed", "parentcaller": "0x7fff58085341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00001af4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff580853d0" }, { "name": "Parameter", "value": "0x04b8bf30" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "9344" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "5952", "caller": "0x7fff5781f430", "parentcaller": "0x7fff58085379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001af4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "9344" }, { "name": "ProcessId", "value": "4484" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "4696", "caller": "0x7ff79bc7b46c", "parentcaller": "0x7ff79be49fd3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "4696", "caller": "0x7ff79bc7b46c", "parentcaller": "0x7ff79be49fd3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4234D49B-0245-4DF3-B780-3893943456E1" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "9344", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000027dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "4580", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cc10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 10:45:23,704", "thread_id": "4580", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cc02000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-29 10:45:23,719", "thread_id": "4580", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0c7e0000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002984" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1282 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002984" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002984" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f58" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1285 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f58" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f58" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002978" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a28" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a28" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1288 }, { "timestamp": "2026-05-29 10:45:24,422", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002978" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002978" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000242c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1291 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000273c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1294 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002718" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002718" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002718" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1297 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000264c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1300 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000279c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1303 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1306 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1309 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002980" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1312 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1315 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1318 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002980" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1321 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1324 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1327 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000279c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1330 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000264c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1333 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002718" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000273c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1336 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002718" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002718" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002718" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002718" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1339 }, { "timestamp": "2026-05-29 10:45:24,438", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000264c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000264c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000264c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1342 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000279c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000279c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000279c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1345 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1348 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002978" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002978" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1351 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002980" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1354 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1357 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029d0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1360 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1363 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1366 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1369 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1372 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1375 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1378 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1381 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029a4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029a4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1384 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a08" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1387 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a08" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a08" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a08" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1390 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002998" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1393 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002998" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002998" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002998" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1396 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000f80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000f80" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001074" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000f80" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000f80" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1399 }, { "timestamp": "2026-05-29 10:45:24,485", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001074" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001074" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 10:45:27,704", "thread_id": "4956", "caller": "0x7fff41dbe842", "parentcaller": "0x7fff59fc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029c4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001af4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fb0000" }, { "name": "SectionOffset", "value": "0x0779f250" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1403 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1405 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 10:45:48,266", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002984" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001074" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 10:45:48,282", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000026c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002984" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002984" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000299c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000299c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001074" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002964" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000299c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000299c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001074" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 10:45:48,297", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000ea4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001074" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002418" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002418" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000273c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029bc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002418" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001074" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002418" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1605 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5856f573", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029c4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 10:45:48,313", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1608 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000242c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779f2e0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0x00002418" }, { "name": "TargetHandle", "value": "0x000014d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x0000242c" }, { "name": "SourceHandle", "value": "0x000014d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002418" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002418" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779f330" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1612 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x00002418" }, { "name": "SourceHandle", "value": "0x000014d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000242c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000242c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02fe0000" }, { "name": "SectionOffset", "value": "0x0779f330" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1614 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4720", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5807f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x00001af4" }, { "name": "SourceHandle", "value": "0x000014d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000273c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fa1281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fa1281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fa1281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ad4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fa1281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026c8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076a9868" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff59f9d2a3", "parentcaller": "0x7fff59f6bac7", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x7fff59fed2c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "::\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000242c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000273c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x00d9de10" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000242c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000db4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025d0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025d0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001074" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001074" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1645 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d520000" }, { "name": "SectionOffset", "value": "0x00d9dd90" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001074" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000025d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002228" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002964" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00f9b281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\imageres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002964" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b20000" }, { "name": "SectionOffset", "value": "0x00d9c210" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc4ebcc", "parentcaller": "0x7ff79bc512d4", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002964" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ea4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15e50000" }, { "name": "SectionOffset", "value": "0x00d9c1c0" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "5952", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15e50000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214E6-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "5952", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ac0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001abc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x0953d570" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076a9b98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "5952", "caller": "0x7fff557d6fb6", "parentcaller": "0x7fff557d6ef4", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "4956", "caller": "0x7ff79bc577f9", "parentcaller": "0x7ff79bc5b6d9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "02C5CCF3-805F-4654-A7B7-340A74335365" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:45:48,766", "thread_id": "9344", "caller": "0x7fff5588d4e4", "parentcaller": "0x7fff557c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e8a281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Discord Inc\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b20000" }, { "name": "SectionOffset", "value": "0x0317d080" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc78f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ad8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fe0000" }, { "name": "SectionOffset", "value": "0x00d9da70" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5952", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001af4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f00" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc78f2b", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f00" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff557c5aab", "parentcaller": "0x7fff557c519f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001af4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076a9868" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c1ab8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "6148", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001780" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "6148", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002228" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x0d51d410" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f00" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5289766a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1703 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002750" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09040000" }, { "name": "SectionOffset", "value": "0x0130e680" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000f00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002964" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 1714 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002450" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Discord Inc\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c50000" }, { "name": "SectionOffset", "value": "0x0943d440" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c3438" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002440" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000b68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d520000" }, { "name": "SectionOffset", "value": "0x0130e600" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002440" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002750" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000243c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000c30" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x16750000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x008f9000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002418" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002418" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x16750000" }, { "name": "RegionSize", "value": "0x008f9000" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002418" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ac8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "SectionOffset", "value": "0x0953e890" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002450" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bc5b8f3", "parentcaller": "0x7ff79bc5b70d", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002418" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002964" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "5952", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5289766a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4840", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5286bde6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c40f8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "2440", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d4" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000253c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 10:45:48,782", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c3dc8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000027d4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002750" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025a4" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c2448" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002a58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12ae0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002904" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028b4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002280" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002520" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ff0000" }, { "name": "SectionOffset", "value": "0x00d9b8c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12ae0000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a9c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d920000" }, { "name": "SectionOffset", "value": "0x0809dd20" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002280" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029fc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000254c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002904" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c32af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029fc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002984" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dba0000" }, { "name": "SectionOffset", "value": "0x0d51e6b0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002520" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ff0000" }, { "name": "SectionOffset", "value": "0x07fcebc0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002904" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001668" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002880" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "9344", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002750" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00001ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028a4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002848" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09060000" }, { "name": "SectionOffset", "value": "0x0b37e640" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028a4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002894" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002750" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ab8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002750" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6220", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x127c0000" }, { "name": "SectionOffset", "value": "0x07fceb40" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6148", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002750" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026c8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x8c50faf4e296", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002438" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "7840", "caller": "0x7fff528866e4", "parentcaller": "0x7fff52884b85", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "591209C7-767B-42B2-9FBA-44EE4615F2C7" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "4E530B0A-E611-4C77-A3AC-9031D022281B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x129c0000" }, { "name": "SectionOffset", "value": "0x0b37e5c0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000229c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002288" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09030000" }, { "name": "SectionOffset", "value": "0x09e6d500" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002bf4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001668" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09010000" }, { "name": "SectionOffset", "value": "0x00d9b8c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff57fc42c4", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002288" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00001f44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12ae0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002848" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000cb4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028e0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12ae0000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09010000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6096", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff58c1937a", "parentcaller": "0x7fff44ddb79d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4740", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "5596", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002bf8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000284c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12ae0000" }, { "name": "SectionOffset", "value": "0x0317e320" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002854" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000283c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002844" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002298" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002840" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09010000" }, { "name": "SectionOffset", "value": "0x02f2e770" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002bf8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002830" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002844" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "6096", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002bfc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001eb8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002894" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002298" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000254c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09030000" }, { "name": "SectionOffset", "value": "0x0943e760" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002894" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002520" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4344", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09200000" }, { "name": "SectionOffset", "value": "0x09eed000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4840", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002784" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 10:45:48,797", "thread_id": "4344", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc1798", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x01261000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5286bde6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002784" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002844" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000278c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002784" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000282c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002bf0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x0317cd00" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002784" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09200000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002784" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff58c1937a", "parentcaller": "0x7fff44ddb79d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "6096", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002880" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000278c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000254c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4580", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000282c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b4c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1853 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000027c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09210000" }, { "name": "SectionOffset", "value": "0x09e6ea30" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x8c50faf4e296", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000283c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000291c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002520" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "RegionSize", "value": "0x00046000" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b20" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001ae0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09330000" }, { "name": "SectionOffset", "value": "0x0a16d1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027e0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09600000" }, { "name": "SectionOffset", "value": "0x00d9b8c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff5286c1d6", "parentcaller": "0x7fff5286bde6", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000283c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x0943d0c0" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b20" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4140", "caller": "0x7ff79bc40b6a", "parentcaller": "0x7ff79bc40a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000283c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00001ed8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Steam\\Steam.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0809cc00" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09330000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff58c1937a", "parentcaller": "0x7fff44ddb79d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "2155FEE3-2419-4373-B102-6843707EB41F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002b20" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002804" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000027d8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c2778" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09330000" }, { "name": "SectionOffset", "value": "0x09eee530" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d6fe6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f68" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1887 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x8c50faf4dbf6", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\WindowsApps\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x8c50faf4fd96", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x8c50faf4f846", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f00" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f00" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002844" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12f20000" }, { "name": "SectionOffset", "value": "0x09eee4b0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001db0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f5c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bd3c72d", "parentcaller": "0x7ff79bc5b965", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002bf0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09200000" }, { "name": "SectionOffset", "value": "0x07fcd520" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f50" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d90" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000d6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4956", "caller": "0x7ff79bc5b9da", "parentcaller": "0x7ff79bc5b70d", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c32af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f50" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4840", "caller": "0x7fff557c5aab", "parentcaller": "0x7fff557c519f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c4758" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010e8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4488", "caller": "0x7ff79bc2c161", "parentcaller": "0x7ff79bcb3e46", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002798" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c32af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002798" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x096a0000" }, { "name": "SectionOffset", "value": "0x09e6eba0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002798" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ad8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4344", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 10:45:48,813", "thread_id": "4740", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002830" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000227c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d6c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000227c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a70" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d920000" }, { "name": "SectionOffset", "value": "0x0a16e680" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000227c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000282c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002870" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13020000" }, { "name": "SectionOffset", "value": "0x09e6eb20" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000c30" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002bf0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57fc42c4", "parentcaller": "0x7fff57fc3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eb8" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57fc44a6", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x4000000e", "arguments": [ { "name": "SectionHandle", "value": "0x00001f5c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0018a000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x09e6dce0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57fd607d", "parentcaller": "0x7fff57fc521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57fc46a1", "parentcaller": "0x7fff57fc3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09200000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b2c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\Steam\\steam.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x0000240c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00708000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f68" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f68" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002628" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x139e0000" }, { "name": "SectionOffset", "value": "0x07fce9d0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000262c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\SystemResources\\steam.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff57826844", "parentcaller": "0x7fff581f26ab", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000260c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d00000" }, { "name": "SectionOffset", "value": "0x07fcd3b0" }, { "name": "ViewSize", "value": "0x00046000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1957 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1961 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4812", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00708000" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4344", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1966 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4840", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1971 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x80028000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1974 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4344", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Gmail.url" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 10:45:48,829", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1978 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 1982 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002920" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4740", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214FA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\WhatsApp Web.url" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000260c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\application\\chrome.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff577d7786", "parentcaller": "0x7fff577d5630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000025f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15e50000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00421000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4344", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15e50000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4344", "caller": "0x7fff577cad9e", "parentcaller": "0x7fff581cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "RegionSize", "value": "0x00421000" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4840", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d90" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 10:45:48,844", "thread_id": "4344", "caller": "0x7fff432c4639", "parentcaller": "0x7fff432c45ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 1998 }, { "timestamp": "2026-05-29 10:45:48,876", "thread_id": "4696", "caller": "0x7ff79bc7a06e", "parentcaller": "0x7ff79bc66f8c", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "DE25675A-72DE-44B4-9373-05170450C140" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 10:45:48,876", "thread_id": "4696", "caller": "0x7ff79bc7a0c1", "parentcaller": "0x7ff79bc66f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 1, "id": 2003 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002830" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002824" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002824" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 10:45:48,969", "thread_id": "6096", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002830" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13170000" }, { "name": "SectionOffset", "value": "0x02f2e3e0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "6096", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002824" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000025f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff55864847", "parentcaller": "0x7fff558645d7", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "50EF4544-AC9F-4A8E-B21B-8A26180DB13F" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "F676C15D-596A-4CE2-8234-33996F445DB1" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x011938c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff5809b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x076c1128" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fd4" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c32af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000fd4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09600000" }, { "name": "SectionOffset", "value": "0x0a16e670" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000fd4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001030" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ad8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ad8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ad8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000102c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13270000" }, { "name": "SectionOffset", "value": "0x0a16e5f0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ad8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001024" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 1, "id": 2024 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000219c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000101c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff432c1c19", "parentcaller": "0x7fff432c1ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000101c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000219c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13370000" }, { "name": "SectionOffset", "value": "0x0a16e2e0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff432c1d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000101c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002828" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0a16d240" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2033 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2037 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2041 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 10:45:48,985", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d90" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000100c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000100c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001004" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001050" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x096b0000" }, { "name": "SectionOffset", "value": "0x0a16d2a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2055 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000282c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002840" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ea4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000ea4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002114" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a14" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x096b0000" }, { "name": "SectionOffset", "value": "0x0a16d2a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ae8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002840" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000026ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000268c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002700" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002704" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x096b0000" }, { "name": "SectionOffset", "value": "0x0a16d2a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 10:45:49,001", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000282c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2081 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2085 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6bcf", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6c28", "parentcaller": "0x7fff577d6f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2089 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d4d82", "parentcaller": "0x7fff577d70c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d4f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff432b643e", "parentcaller": "0x7fff432b8101", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DE77BA04-3C92-4D11-A1A5-42352A53E0E3" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7A3BD1D9-35A9-4FB3-A467-F48CAC35E2D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2095 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff557c5aab", "parentcaller": "0x7fff557c519f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff5807c5e9", "parentcaller": "0x7fff5807fc58", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "265CFCAA-9B0C-44CA-996F-4A6F6620C72D" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff5781c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff58096fcb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000026e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000026dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001004" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000100c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x096b0000" }, { "name": "SectionOffset", "value": "0x0a16d2a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\Discord.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 10:45:49,016", "thread_id": "4812", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff55824fbc", "parentcaller": "0x7fff5581f4db", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff5581d809", "parentcaller": "0x7fff5581d730", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0340F119-A598-4ED9-B0AC-6F6A12D3E755" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "7F73BE3F-FB79-493C-A6C7-7EE14E245841" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff584cf303", "parentcaller": "0x7fff584ce7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff558259d3", "parentcaller": "0x7fff55896922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "7840", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2126 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff578186ed", "parentcaller": "0x7fff432b9455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000261c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff55825882", "parentcaller": "0x7fff558495d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "FBF23B40-E3F0-101B-8488-00AA003E56F8" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "InternetShortcut" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41281ead", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "942BC614-676C-464E-B384-D3202AAA02DA" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff41396d8c", "parentcaller": "0x7fff41378e23", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "06EEE834-461C-42C2-8DCF-1502B527B1F9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000010B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff4136a287", "parentcaller": "0x7fff41378e41", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DFED3F9-B794-4D3C-973B-DDA1C28105A9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "B7F02995-84DD-4F19-970A-1625E95C8BD0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff432c5ded", "parentcaller": "0x7fff432c56be", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "AB8902B4-09CA-4BB6-B78D-A8F59079A8D5" }, { "name": "ClsContext", "value": "0x00004004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_FAILURE_LOG" }, { "name": "riid", "value": "75121952-E0D0-43E5-9380-1D80483ACF72" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 10:45:49,032", "thread_id": "4812", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff558258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 2140 } ], "threads": [ "6148", "4720", "4696", "2440", "5100", "4840", "5096", "5108", "5000", "6220", "7840", "6252", "4744", "5952", "6096", "4668", "4772", "5228", "4488", "4340", "4672", "4580", "4576", "4500", "4664", "3424", "5220", "4812", "4344", "4740", "4140", "4956", "6160", "11812", "5596", "12160", "12188", "9344" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\Explorer.EXE", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff79bc10000", "MainExeSize": "0x00546000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 4104, "process_name": "msedge.exe", "parent_id": 4484, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "first_seen": "2026-05-29 10:44:22,018", "calls": [ { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\version" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:44:22,096", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:44:22,268", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINMM" }, { "name": "DllBase", "value": "0x7fff453c0000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:44:22,268", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x7ffefe540000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:44:22,268", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:44:22,268", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:44:22,268", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "8792", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000036c" }, { "name": "ThreadHandle", "value": "0x00000368" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff16f35d58,0x7fff16f35d64,0x7fff16f35d70" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1204" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7fff3e220000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "8792", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff599d7d70", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff16f35d58,0x7fff16f35d64,0x7fff16f35d70" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1204" }, { "name": "ThreadId", "value": "1944" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000036c" }, { "name": "ThreadHandle", "value": "0x00000368" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\gpapi" }, { "name": "DllBase", "value": "0x7fff55ec0000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wkscli" }, { "name": "DllBase", "value": "0x7fff56750000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:44:22,284", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff16a40000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff15300000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff3f6a0000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff16a40000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff3f6a0000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff15300000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:44:22,299", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AssignedAccessRuntime" }, { "name": "DllBase", "value": "0x7fff4cfa0000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7fff58380000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SystemSettings.DataModel" }, { "name": "DllBase", "value": "0x7fff4d3d0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DWrite" }, { "name": "DllBase", "value": "0x7fff49a90000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32" }, { "name": "DllBase", "value": "0x7fff44d50000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "3368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x7fff57350000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7fff569f0000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:44:22,315", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NLAapi" }, { "name": "DllBase", "value": "0x7fff52960000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7fff58b20000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x7fff515c0000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "2864", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StructuredQuery" }, { "name": "DllBase", "value": "0x7fff4b070000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x7fff515a0000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "2864", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\PROPSYS" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x7fff56a40000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x7fff54850000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x7fff54170000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x7fff4b680000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:44:22,331", "thread_id": "2864", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Windows.Storage.Search" }, { "name": "DllBase", "value": "0x7fff4cd70000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twinapi" }, { "name": "DllBase", "value": "0x7fff45580000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wevtapi" }, { "name": "DllBase", "value": "0x7fff52420000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "3368", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\edputil" }, { "name": "DllBase", "value": "0x7fff47ab0000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WindowManagementAPI" }, { "name": "DllBase", "value": "0x7fff51a60000" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\InputHost" }, { "name": "DllBase", "value": "0x7fff4af10000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI" }, { "name": "DllBase", "value": "0x7fff4bfb0000" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7fff47980000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:44:22,346", "thread_id": "8912", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x7fff52b00000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:44:22,362", "thread_id": "3372", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient" }, { "name": "DllBase", "value": "0x7fff515e0000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:44:22,362", "thread_id": "3372", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\mscms" }, { "name": "DllBase", "value": "0x7fff51600000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:44:22,362", "thread_id": "8912", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7fff57360000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:44:22,362", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:44:22,378", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth" }, { "name": "DllBase", "value": "0x7fff15a80000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:44:22,378", "thread_id": "3256", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a20" }, { "name": "ThreadHandle", "value": "0x00000a1c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2388,i,8823613399287029355,12022979517610140969,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "2168" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:44:22,378", "thread_id": "3256", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2388,i,8823613399287029355,12022979517610140969,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2168" }, { "name": "ThreadId", "value": "8720" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a20" }, { "name": "ThreadHandle", "value": "0x00000a1c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:44:22,393", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Secur32" }, { "name": "DllBase", "value": "0x7fff48330000" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:44:22,393", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI.Immersive" }, { "name": "DllBase", "value": "0x7fff49d10000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:44:22,393", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a4c" }, { "name": "ThreadHandle", "value": "0x00000a48" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,16090793344968355769,14585619003076371751,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2440 /prefetch:2" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1332" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:44:22,393", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,16090793344968355769,14585619003076371751,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2440 /prefetch:2" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1332" }, { "name": "ThreadId", "value": "7928" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a4c" }, { "name": "ThreadHandle", "value": "0x00000a48" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:44:22,393", "thread_id": "6740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sxs" }, { "name": "DllBase", "value": "0x7fff573c0000" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:44:22,409", "thread_id": "6740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:44:22,409", "thread_id": "6740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager" }, { "name": "DllBase", "value": "0x7fff409a0000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:44:22,409", "thread_id": "3372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000b04" }, { "name": "ThreadHandle", "value": "0x00000b0c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,17890292518401804609,7034942189224193145,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2764 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4760" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:44:22,409", "thread_id": "3744", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x7fff43590000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:44:22,424", "thread_id": "3372", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,17890292518401804609,7034942189224193145,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2764 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4760" }, { "name": "ThreadId", "value": "1108" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000b04" }, { "name": "ThreadHandle", "value": "0x00000b0c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:44:22,456", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dxgi" }, { "name": "DllBase", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:44:22,456", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\d3d11" }, { "name": "DllBase", "value": "0x7fff53070000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:44:22,471", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcomp" }, { "name": "DllBase", "value": "0x7fff538a0000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:44:22,471", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dataexchange" }, { "name": "DllBase", "value": "0x7fff43630000" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:44:22,487", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo" }, { "name": "DllBase", "value": "0x7fff18950000" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:44:22,503", "thread_id": "6740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dwmapi" }, { "name": "DllBase", "value": "0x7fff55220000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\OLEACC" }, { "name": "DllBase", "value": "0x7fff43990000" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "8576", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000eb8" }, { "name": "ThreadHandle", "value": "0x00000ee0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186407985 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3560,i,11676548911406118748,16820735849445238907,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3556 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4108" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "5828", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f0c" }, { "name": "ThreadHandle", "value": "0x00000f00" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186410130 --skip-read-main-dll --metrics-shmem-handle=3668,i,2396491602889113873,12485579353753644802,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3748 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "5820" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\directmanipulation" }, { "name": "DllBase", "value": "0x7fff488b0000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186407985 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3560,i,11676548911406118748,16820735849445238907,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3556 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4108" }, { "name": "ThreadId", "value": "1404" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000eb8" }, { "name": "ThreadHandle", "value": "0x00000ee0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:44:22,518", "thread_id": "5828", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186410130 --skip-read-main-dll --metrics-shmem-handle=3668,i,2396491602889113873,12485579353753644802,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3748 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "5820" }, { "name": "ThreadId", "value": "5852" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000f0c" }, { "name": "ThreadHandle", "value": "0x00000f00" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:44:22,581", "thread_id": "8764", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core" }, { "name": "DllBase", "value": "0x7fff456d0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:44:22,596", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VCRUNTIME140" }, { "name": "DllBase", "value": "0x7fff3f8a0000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:44:22,596", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions" }, { "name": "DllBase", "value": "0x7fff42bf0000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:44:22,612", "thread_id": "4964", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains" }, { "name": "DllBase", "value": "0x7fff16390000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:44:22,612", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:44:22,612", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vaultcli" }, { "name": "DllBase", "value": "0x7fff3e730000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:44:22,628", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\aadWamExtension" }, { "name": "DllBase", "value": "0x7fff16350000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:44:22,628", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:44:22,643", "thread_id": "4336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension" }, { "name": "DllBase", "value": "0x7fff162c0000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:44:22,643", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:44:22,643", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\rsaenh" }, { "name": "DllBase", "value": "0x7fff56630000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:44:23,878", "thread_id": "2912", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:44:24,299", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:44:24,299", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:44:24,299", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:44:24,299", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:44:27,534", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SETUPAPI" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:44:27,534", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DEVOBJ" }, { "name": "DllBase", "value": "0x7fff572f0000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:44:27,534", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001540" }, { "name": "ThreadHandle", "value": "0x00001524" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5328,i,12626311780650901669,14176311243473770968,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5368 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9328" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:44:27,549", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netprofm" }, { "name": "DllBase", "value": "0x7fff54b30000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:44:27,549", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001564" }, { "name": "ThreadHandle", "value": "0x00001560" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5340,i,17745413209609224926,8469148961402733420,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5428 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9344" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:44:27,565", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:44:27,581", "thread_id": "8576", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5328,i,12626311780650901669,14176311243473770968,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5368 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9328" }, { "name": "ThreadId", "value": "9332" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001540" }, { "name": "ThreadHandle", "value": "0x00001524" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:44:27,596", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5340,i,17745413209609224926,8469148961402733420,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5428 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9344" }, { "name": "ThreadId", "value": "9348" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001564" }, { "name": "ThreadHandle", "value": "0x00001560" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:44:27,659", "thread_id": "3276", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient" }, { "name": "DllBase", "value": "0x7ffefb560000" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:44:27,862", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg" }, { "name": "DllBase", "value": "0x7fff164c0000" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:44:27,862", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x7fff4f560000" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:44:27,909", "thread_id": "3276", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds" }, { "name": "DllBase", "value": "0x7ffefaf00000" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:44:28,065", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\FirewallAPI" }, { "name": "DllBase", "value": "0x7fff56250000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:44:28,065", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\fwbase" }, { "name": "DllBase", "value": "0x7fff561e0000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:44:28,081", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration" }, { "name": "DllBase", "value": "0x7fff12eb0000" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:44:28,112", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:44:28,112", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:44:28,112", "thread_id": "340", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:44:28,674", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\TenantRestrictionsPlugin" }, { "name": "DllBase", "value": "0x7fff150c0000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:44:28,721", "thread_id": "9524", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f18" }, { "name": "ThreadHandle", "value": "0x000012f4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9528" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:44:30,143", "thread_id": "9524", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7fff501a0000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:44:30,143", "thread_id": "9524", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.staterepositorycore" }, { "name": "DllBase", "value": "0x7fff4cbd0000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:44:30,143", "thread_id": "9524", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000000c8" }, { "name": "ThreadHandle", "value": "0x000012f4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" }, { "name": "DllPath", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application;" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:44:30,331", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7fff4f950000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:44:30,331", "thread_id": "6796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7fff4f950000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:44:30,331", "thread_id": "9524", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080400", "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9656" }, { "name": "ThreadId", "value": "9660" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000000c8" }, { "name": "ThreadHandle", "value": "0x000012f4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:44:30,581", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel" }, { "name": "DllBase", "value": "0x7fff457f0000" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:44:30,581", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AppXDeploymentClient" }, { "name": "DllBase", "value": "0x7fff4f740000" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\PCPKsp" }, { "name": "DllBase", "value": "0x7fff50370000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:44:30,690", "thread_id": "1728", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\ncryptprov" }, { "name": "DllBase", "value": "0x7fff45050000" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:44:30,878", "thread_id": "3520", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mswsock" }, { "name": "DllBase", "value": "0x7fff56d00000" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "8276", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings" }, { "name": "DllBase", "value": "0x7fff18180000" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:44:52,378", "thread_id": "3256", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x000015a4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,13601508909079690424,398805377896742876,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3676 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "10500" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:44:52,378", "thread_id": "3256", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,13601508909079690424,398805377896742876,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3676 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "10500" }, { "name": "ThreadId", "value": "10504" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015a0" }, { "name": "ThreadHandle", "value": "0x000015a4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:44:55,893", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001824" }, { "name": "ThreadHandle", "value": "0x00001860" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=219783184 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6168,i,11591325124669200099,14631802058767790145,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1624 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "11408" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:44:55,893", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=219783184 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6168,i,11591325124669200099,14631802058767790145,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1624 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "11408" }, { "name": "ThreadId", "value": "11412" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001824" }, { "name": "ThreadHandle", "value": "0x00001860" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:45:22,346", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sppc" }, { "name": "DllBase", "value": "0x7fff56140000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:45:22,346", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\slc" }, { "name": "DllBase", "value": "0x7fff56170000" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:45:22,346", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\slwga" }, { "name": "DllBase", "value": "0x7fff17400000" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:45:22,378", "thread_id": "3036", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient" }, { "name": "DllBase", "value": "0x7fff17220000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:45:22,424", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000ee8" }, { "name": "ThreadHandle", "value": "0x00001704" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5412,i,5337591086858526967,16474943761420232357,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6432 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1196" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:45:22,424", "thread_id": "5984", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5412,i,5337591086858526967,16474943761420232357,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6432 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1196" }, { "name": "ThreadId", "value": "4460" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000ee8" }, { "name": "ThreadHandle", "value": "0x00001704" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:45:22,628", "thread_id": "4828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CloudExperienceHostCommon" }, { "name": "DllBase", "value": "0x7ffefbae0000" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:46:22,362", "thread_id": "3256", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000e80" }, { "name": "ThreadHandle", "value": "0x00000f28" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4004,i,7092498328383177707,8111344416296456205,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3448 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "14232" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:46:22,362", "thread_id": "3256", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4004,i,7092498328383177707,8111344416296456205,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3448 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "14232" }, { "name": "ThreadId", "value": "14236" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000e80" }, { "name": "ThreadHandle", "value": "0x00000f28" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 } ], "threads": [ "4828", "8792", "5984", "3368", "4336", "2864", "8940", "8912", "3372", "3256", "8576", "6740", "3744", "5828", "8764", "4964", "2912", "6796", "340", "3276", "1728", "9524", "3520", "8276", "3036" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7f5380000", "MainExeSize": "0x00505000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 9656, "process_name": "identity_helper.exe", "parent_id": 4104, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "first_seen": "2026-05-29 10:44:30,360", "calls": [ { "timestamp": "2026-05-29 10:44:30,547", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000060", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c32a60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:44:30,579", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000010", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c8c510" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:44:30,610", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000024", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c65c30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:44:30,626", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000090", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c8c590" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:44:30,657", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16bfefd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:44:30,688", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000050", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c61950" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16caf156", "parentcaller": "0x7fff16cb0c0a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16cafaa7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16cafaa7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16cafaa7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16cafaa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16cafaa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bd9070", "parentcaller": "0x7fff16c62c96", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bd9070", "parentcaller": "0x7fff16c62c96", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bd9070", "parentcaller": "0x7fff16c62c96", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bd9089", "parentcaller": "0x7fff16c62c96", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c63b9c", "parentcaller": "0x7fff16c63d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c63b9c", "parentcaller": "0x7fff16c63d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5c864e440000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c63c18", "parentcaller": "0x7fff16bdb8df", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5c864e441000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cb006a", "parentcaller": "0x7fff16cb0c0a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x2592ae05890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cb0077", "parentcaller": "0x7fff16cb0c0a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf6c7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf6c7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf6c7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bd3c0" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf1d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf1d6", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf1d6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0f00" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1c301", "parentcaller": "0x7fff16c9fa72", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1c311", "parentcaller": "0x7fff16c9fa72", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd5350" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf8f9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf8f9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf8f9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c7130" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf922", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57827f40" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf94b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16caf94b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf94b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578155b0" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf974", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c0210" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf99d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5781d1a0" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf9c6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577dae80" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16caf9ef", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bad90" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16caf9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16caf9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16cafa41", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafb27", "parentcaller": "0x7fff16cafa41", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16cafa41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bae60" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16cafa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16cafa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc58", "parentcaller": "0x7fff16cafa6a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57810070" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafbd7", "parentcaller": "0x7fff16cafa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16cafc08", "parentcaller": "0x7fff16cafa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff16f5f000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000098000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c27e31", "parentcaller": "0x7fff16bab049", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c27e31", "parentcaller": "0x7fff16bab049", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c27e4a", "parentcaller": "0x7fff16bab049", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c20e68", "parentcaller": "0x7fff16c20dc8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usp10.dll" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10700009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1fbd4", "parentcaller": "0x7fff16c20076", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xe6/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1fc42", "parentcaller": "0x7fff16c20076", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1fcd6", "parentcaller": "0x7fff16c20076", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1fce6", "parentcaller": "0x7fff16c20076", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "IsWow64Process" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fcf980" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c2019b", "parentcaller": "0x7fff16c203bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c202c2", "parentcaller": "0x7fff16c20346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "channel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c202c2", "parentcaller": "0x7fff16c20346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "channel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "stable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c203ea", "parentcaller": "0x7fff16c208ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:44:30,735", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c2019b", "parentcaller": "0x7fff16c203bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c202c2", "parentcaller": "0x7fff16c20346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c203ea", "parentcaller": "0x7fff16c2195d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c1feef", "parentcaller": "0x7fff16c200f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c2019b", "parentcaller": "0x7fff16c203bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c202c2", "parentcaller": "0x7fff16c20346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c202c2", "parentcaller": "0x7fff16c20346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c203ea", "parentcaller": "0x7fff16c219ed", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000094" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fba190" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0170" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000240" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000244" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f200000" }, { "name": "SectionOffset", "value": "0xfc372fe4a0" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16ce32c9", "parentcaller": "0x7fff16c2094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c20fba", "parentcaller": "0x7fff16bf5699", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000d4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bf55e1", "parentcaller": "0x7fff16bf56aa", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 1, "id": 144 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16bdba80", "parentcaller": "0x7fff16bdab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1070000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c6f562", "parentcaller": "0x7fff16e275e5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c6f562", "parentcaller": "0x7fff16e275e5", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16e275e5", "parentcaller": "0x7fff16e220c4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd4d00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c6f3fe", "parentcaller": "0x7fff16e22105", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\pipe\\crashpad_4104_VNIRRYNIERXILDVP" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c6f425", "parentcaller": "0x7fff16e22105", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000244" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\crashpad_4104_VNIRRYNIERXILDVP" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c6f9bb", "parentcaller": "0x7fff16c6ff6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16e20ad2", "parentcaller": "0x7fff16e2213f", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7fff16e21e30" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16e20ae4", "parentcaller": "0x7fff16e2213f", "category": "hooking", "api": "RtlAddVectoredExceptionHandler", "status": true, "return": "0x2592c8f07e0", "arguments": [ { "name": "First", "value": "1" }, { "name": "Handler", "value": "0x7fff16e21f50" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c22947", "parentcaller": "0x7fff16c228b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16c22947", "parentcaller": "0x7fff16c228b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16d22986", "parentcaller": "0x7fff16d228f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c7892000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16d229aa", "parentcaller": "0x7fff16d228f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c7892000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:44:30,751", "thread_id": "9660", "caller": "0x7fff16d229aa", "parentcaller": "0x7fff16d228f3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff16ab0000" }, { "name": "InitRoutine", "value": "0x7fff16c8d2f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff4753125f", "parentcaller": "0x7fff57c7e473", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae35000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff5780c976", "parentcaller": "0x7fff475481dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae36000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff577dac31", "parentcaller": "0x7fff47548089", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTempPathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57814af0" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:44:30,766", "thread_id": "9660", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp" }, { "name": "BaseAddress", "value": "0x7fff47530000" }, { "name": "InitRoutine", "value": "0x7fff4754b1a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:44:30,782", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x000000a0", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c76ffba0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:44:30,797", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c7744280" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:44:30,813", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x0000003d", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c772a0e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:44:30,829", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c7744300" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:44:30,844", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c76e5840" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9660", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff6c7670000" }, { "name": "InitRoutine", "value": "0x7ff6c7725f80" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9660", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9660", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff6c7744f90" }, { "name": "Parameter", "value": "0xfc37166000" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9788", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000003c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 189 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9792", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae24000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9792", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9792", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9792", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9788", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af05000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9788", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9788", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9796", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae25000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9796", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18342030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9800", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9800", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:44:30,860", "thread_id": "9800", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764096", "parentcaller": "0x7ff6c7765b4a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c77649e7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c77649e7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c77649e7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c77649e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c77649e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d1500", "parentcaller": "0x7ff6c7727156", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d1500", "parentcaller": "0x7ff6c7727156", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d1519", "parentcaller": "0x7ff6c7727156", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c772805c", "parentcaller": "0x7ff6c7728237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c772805c", "parentcaller": "0x7ff6c7728237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1623204f0000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c77280d8", "parentcaller": "0x7ff6c76d297f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1623204f1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764faa", "parentcaller": "0x7ff6c7765b4a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x2592ae05890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764fb7", "parentcaller": "0x7ff6c7765b4a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764607", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764607", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764607", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bd3c0" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c776b002", "parentcaller": "0x7ff6c7755732", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae26000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x57000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x5700009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f2d71", "parentcaller": "0x7ff6c7755bf2", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f2d81", "parentcaller": "0x7ff6c7755bf2", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd5350" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000b4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764834", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764834", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764834", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0f00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764839", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764839", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764839", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c7130" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764862", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57827f40" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c776488b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c776488b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c776488b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578155b0" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c776488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c776488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c77648b4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c0210" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c77648b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c77648b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c77648dd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5781d1a0" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c77648dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c77648dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764906", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577dae80" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c776492f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bad90" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c776492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c776492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764981", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764a67", "parentcaller": "0x7ff6c7764981", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c7764981", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bae60" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c7764981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c7764981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b98", "parentcaller": "0x7ff6c77649aa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57810070" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b17", "parentcaller": "0x7ff6c77649aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7764b48", "parentcaller": "0x7ff6c77649aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff6c78f4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f6e14", "parentcaller": "0x7ff6c76f6b29", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f6e24", "parentcaller": "0x7ff6c76f6b29", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f8f850" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f6e44", "parentcaller": "0x7ff6c76f6b29", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f6e44", "parentcaller": "0x7ff6c76f6b29", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000248" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76f6e44", "parentcaller": "0x7ff6c76f6b29", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c77a68ce", "parentcaller": "0x7ff6c768ad91", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2592ae03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724315", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724315", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724315", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7fff58070000" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724315", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58070000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724331", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff58070000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724348", "parentcaller": "0x7ff6c77a692b", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x2592ae257a0", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" }, { "name": "NumArgs", "value": "13" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae27000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7724398", "parentcaller": "0x7ff6c77a692b", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b20", "parentcaller": "0x7ff6c76d1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b20", "parentcaller": "0x7ff6c76d1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ade6", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768adf6", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57febbf0" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c940000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 309 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c950000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae16", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae81", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 313 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae81", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768ae81", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768af7f", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 316 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768af7f", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c768af7f", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b20", "parentcaller": "0x7ff6c76d1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b20", "parentcaller": "0x7ff6c76d1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c7725da1", "parentcaller": "0x7ff6c7839e0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fab91", "parentcaller": "0x7ff6c76a6aa9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fab91", "parentcaller": "0x7ff6c76a6aa9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fabaa", "parentcaller": "0x7ff6c76a6aa9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fb5e6", "parentcaller": "0x7ff6c772308f", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fb5e6", "parentcaller": "0x7ff6c772308f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0xa0100080", "pretty_value": "GENERIC_READ|GENERIC_EXECUTE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fba1c", "parentcaller": "0x7ff6c76fbc6d", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000024c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fba51", "parentcaller": "0x7ff6c76fbc6d", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x25931000000" }, { "name": "SectionOffset", "value": "0xfc372ff550" }, { "name": "ViewSize", "value": "0x136be000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fbe04", "parentcaller": "0x7ff6c76fc9a4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:44:30,891", "thread_id": "9660", "caller": "0x7ff6c76fbe14", "parentcaller": "0x7ff6c76fc9a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "PrefetchVirtualMemory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57826590" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76fbd36", "parentcaller": "0x7ff6c7721e1d", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x25931000000" }, { "name": "RegionSize", "value": "0x136be000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76f698c", "parentcaller": "0x7ff6c76a4c5a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff6c7670000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff6c76f6850" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76d2b9b", "parentcaller": "0x7ff6c76d254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x570000f8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76a4cc2", "parentcaller": "0x7ff6c76fbd52", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "71" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76a4cc2", "parentcaller": "0x7ff6c76fbd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:44:30,907", "thread_id": "9660", "caller": "0x7ff6c76a4cc2", "parentcaller": "0x7ff6c76a6db8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x25931000000" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "BaseAddress", "value": "0x25931000000" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b3c0", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x25931000000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b5f1", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000250" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff6c768b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9996" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "identity_helper.exe" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b5f1", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000250", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff6c768b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9996" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b620", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msedge.dll" }, { "name": "ModuleHandle", "value": "0x25931000000" }, { "name": "FunctionName", "value": "ChromeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2593230a5c0" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff6c768b680" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7fff57c60000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7fff57c60000" }, { "name": "FunctionName", "value": "signal" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57cd18e0" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000d8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x7fff599c0000" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff599c0000", "arguments": [ { "name": "lpLibFileName", "value": "ADVAPI32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92e80" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "EventSetInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92af0" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff54fc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7fff54fc0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff54fccde0" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xef\\xaf7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000200" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10004" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000200", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10004" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000026c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae38000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000026c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080002d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff6c7670000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff6c76f6850" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080010c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800124000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c100" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000268" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577f4448", "parentcaller": "0x259312ffe48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x71e4c5e21000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577ce76a", "parentcaller": "0x259322cef1b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "Kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff5780156c", "parentcaller": "0x259322cef2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578139c0" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x259322ceecc", "parentcaller": "0x2593230a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "LoaderLockSampler" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x259322ceee8", "parentcaller": "0x2593230a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080002a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080002b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "10004", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220eec1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 404 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58490000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000254" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845b000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00g\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00l\\x00e\\x00s\\x00\\x02\\x00\\x00\\x00x\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00c\\x00r\\x00o\\x00\\x02\\x00\\x00\\x00f\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00\\\\x00A\\x00p\\x00\\x02\\x00\\x00\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00\\\\x001\\x004\\x00\\x02\\x00\\x00\\x000\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x008\\x003\\x00\\\\x00\\x02\\x00\\x00\\x00u\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00t\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x007G@a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7fff58380000" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x000\\xbe\\x00\\x00\\x00\\x00\\x00\\x00%\\xbe\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000278" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x259446c0000" }, { "name": "SectionOffset", "value": "0xfc372fe720" }, { "name": "ViewSize", "value": "0x00be3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf" }, { "name": "BaseAddress", "value": "0x7fff58380000" }, { "name": "InitRoutine", "value": "0x7fff583c0760" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff581a9000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff581a9000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000280" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000290" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000290" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\ThemeSection" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000280" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x0b\\x00\\x00\\x00\\x00\\x00\\x88=\\x0b\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c970000" }, { "name": "SectionOffset", "value": "0xfc37afe5e0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme2282685266" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f540000" }, { "name": "SectionOffset", "value": "0xfc372fed70" }, { "name": "ViewSize", "value": "0x000b4000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme2610812591" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c970000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f800000" }, { "name": "SectionOffset", "value": "0xfc37afed00" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c970000" }, { "name": "SectionOffset", "value": "0xfc37afed00" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7fff577dac31", "parentcaller": "0x7fff54fc9252", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9996", "caller": "0x7ff6c768b737", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:44:30,922", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000029c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xb0\\x13\\x00\\x00\\x00\\x00\\x00\\xf7\\xa4\\x13\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f8f0000" }, { "name": "SectionOffset", "value": "0xfc372fe4d0" }, { "name": "ViewSize", "value": "0x0013b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002ac" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00cY\\x1e\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fa30000" }, { "name": "SectionOffset", "value": "0xfc372fe4d0" }, { "name": "ViewSize", "value": "0x001e6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080012c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800148000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080015c000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800125000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b4" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b4" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\r\\x00\\x00\\x00\\x00\\x00 U\r\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fc20000" }, { "name": "SectionOffset", "value": "0xfc372fe4e0" }, { "name": "ViewSize", "value": "0x000d6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00P\\x1d\\x02\\x00\\x00\\x00\\x00LA\\x1d\\x02\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x259452b0000" }, { "name": "SectionOffset", "value": "0xfc372fe5e0" }, { "name": "ViewSize", "value": "0x021d5000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800168000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegisterTraceGuidsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92a10" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6ac0" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002c8" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d61d0" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc7\\x04\\x00\\x08\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "IsValidSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6d80" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "GetLengthSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d68c0" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "ConvertSidToStringSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d5a70" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f8f850" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff581b0000", "arguments": [ { "name": "lpLibFileName", "value": "USER32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "PostThreadMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d7ee0" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "9656" }, { "name": "ThreadId", "value": "9660" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "PeekMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581ba3e0" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySection" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed9f0" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000099c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-wow64-l1-1-1.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578170e0" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6180" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x000002c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6160" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" }, { "name": "ValueName", "value": "UBR" }, { "name": "Data", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" }, { "name": "ValueName", "value": "DisplayVersion" }, { "name": "Data", "value": "22H2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6930" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578170e0" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000099c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c990000" }, { "name": "SectionOffset", "value": "0xfc372fedc0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c990000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000099c" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000017a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000099c" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000099c" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000017a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fd00000" }, { "name": "SectionOffset", "value": "0xfc372fecb0" }, { "name": "ViewSize", "value": "0x00080000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000017a0" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000998" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c990000" }, { "name": "SectionOffset", "value": "0xfc372feab0" }, { "name": "ViewSize", "value": "0x00040000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080009d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800059000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080009e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080004d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080009f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080005a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800049000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080017c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080017d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080005b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080004e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000998" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800180000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c310" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10012" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002c8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c310" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10012" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae39000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800169000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af06000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x167\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00\\xbc%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd080006c310" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000027c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x259322ceecc", "parentcaller": "0x2593230a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "PerfettoTrace" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x259322ceee8", "parentcaller": "0x2593230a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800190000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800191000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080005d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800192000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800194000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800193000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080019c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080019f000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08001a2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd08001a5000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "Kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578c8e60" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00p\\x9c\\xe0*Y\\x02\\x00\\x00\\x9e\\xf1\\xa810G@a(\\xae\\xe0*Y\\x02\\x00\\x00x\\x8d\\xe3*Y\\x02\\x00\\x00\\xf8\\x93\\xe0*Y\\x02\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x9c\\xe0*Y\\x02\\x00\\x00\\x9e\\xf1\\xa810G@a(\\xae\\xe0*Y\\x02\\x00\\x00x\\x8d\\xe3*Y\\x02\\x00\\x00\\xf8\\x93\\xe0*Y\\x02\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 1, "id": 580 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57febbf0" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 595 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 600 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080016b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800192000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080019f000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800165000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x71e4c5c23000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00002000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00024000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00030000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800210000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:44:30,938", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00040000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00050000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00054000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050200" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10016" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002d4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050200" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10016" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff16bdbafb", "parentcaller": "0x7fff16bdb4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107000006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800212000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00068000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050200" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0007c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff578c8ec6", "parentcaller": "0x259322b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xb5\\xe3*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10016" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x259322ceecc", "parentcaller": "0x259324f1293", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "HangWatcher" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x259322ceee8", "parentcaller": "0x259324f1293", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10016", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xb5\\xe3*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "winrt_app_id.CrUtilityMain" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050160" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10020" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002f8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050160" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10020" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f530fd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592add1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae48000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800213000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050160" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000308" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080021c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd080020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00025000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0008d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae49000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff578c8ec6", "parentcaller": "0x259322b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x90\\xe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10020" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x259322ceecc", "parentcaller": "0x2593230a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolServiceThread" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x259322ceee8", "parentcaller": "0x2593230a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10020", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220eec1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000304" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050140" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10024" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000304", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050140" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10024" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800215000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00069000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050140" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000031c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0006d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0007d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff578c8ec6", "parentcaller": "0x259322b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x9b\\xe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10024" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0009e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x259322ceecc", "parentcaller": "0x259322ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolForegroundWorker" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x259322ceee8", "parentcaller": "0x259322ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577c30ce", "parentcaller": "0x25932254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10024", "caller": "0x7fff577c30ce", "parentcaller": "0x25932254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" }, { "name": "Milliseconds", "value": "60156" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10028" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000318", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10028" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00059000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae3f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800216000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c00050100" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff5780c6f3", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00,'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10028" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff5780c728", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "24" }, { "name": "ThreadInformation", "value": "\\x05\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10028" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff5780c752", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "22" }, { "name": "ThreadInformation", "value": "\\x02\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10028" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff5780ebae", "parentcaller": "0x25931c4c4eb", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00,'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\xff\\xff\\xff" }, { "name": "ThreadId", "value": "10028" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000032c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0008e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff578c8ec6", "parentcaller": "0x259322b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x9c\\xe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10028" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x259322ceecc", "parentcaller": "0x259322ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolBackgroundWorker" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x259322ceee8", "parentcaller": "0x259322ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff577c30ce", "parentcaller": "0x25932254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10028", "caller": "0x7fff577c30ce", "parentcaller": "0x25932254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" }, { "name": "Milliseconds", "value": "60155" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000328" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c000500c0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10032" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000328", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x259322c9bd0" }, { "name": "Parameter", "value": "0xd0c000500c0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10032" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae40000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af07000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000c4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800218000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00009000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57806f4c", "parentcaller": "0x259322c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000033c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00015000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00026000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff578c8ec6", "parentcaller": "0x259322b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x94\\xe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10032" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0009f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x259322ceecc", "parentcaller": "0x2593230a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "Chrome_ChildIOThread" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x259322ceee8", "parentcaller": "0x2593230a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000e8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000b1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000c1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000c2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800219000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10012", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0006e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000c3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00051000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57820e99", "parentcaller": "0x25932ad9c7a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "@\\x03\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\r\\x00\\x0c\r\\x00\\x00" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000e1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00007000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00104000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x25932ad9b5f", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00P\\x00\\x00\\x00]\\x1e\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "80" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0006a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0000b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00106000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57806f4c", "parentcaller": "0x25931444292", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000344" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d6785", "parentcaller": "0x259314442a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000004" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c9d0000" }, { "name": "SectionOffset", "value": "0xfc381fe9b0" }, { "name": "ViewSize", "value": "0x00020000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7ff6c76a4c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00114000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "8000" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "8000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x25931ca0093", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x006(\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00055000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00016000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00120000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0007e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0012c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "48" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x81+\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff57801762", "parentcaller": "0x259312bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\xeb!\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd7U\\x8dN\\x00\\x00\\x00\\x00\\xf5k\\x12\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x05\\x00\\x00@\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "376" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000ae000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x95+\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xdd4\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0008f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xd61\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xdd4\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:44:30,954", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xa0\\x01\\x00\\x00\\xdc1\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00P\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x87\\x1bV\\x00\\x00\\x00\\x00\\xcfkC\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "416" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x133\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x06\\x00\\x00@\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00h4\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00z\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x06\\x00\\x00@\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xfa<\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00y>\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "200" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xe16\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x06\\x00\\x00@\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00027000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000a0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xfa<\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00y>\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "200" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\xe36\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00B\\x1aQ\\x13\\x01\\x00\\x00\\x00\\xcdkC\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "184" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x00\\x00\\x00\\xff6\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00$\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "56" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff57806f4c", "parentcaller": "0x25931444292", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff57806f4c", "parentcaller": "0x25931444292", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000344" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x89E\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x918\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00@\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x89E\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000354" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\xcd8\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\xb1\\xd4T\\x00\\x00\\x00\\x00\\xcbkC\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "312" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x05L\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb2;\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xafO\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xae<\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x07\\x00\\x00@\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae42000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xafO\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae4a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xb4?\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x84B\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0005a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000e3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c000b2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xa6I\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000004" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592c9f0000" }, { "name": "SectionOffset", "value": "0xfc372fd060" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000344" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fd80000" }, { "name": "SectionOffset", "value": "0xfc372fd060" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c76a4c88", "parentcaller": "0x7ff6c768b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "10032", "caller": "0x7fff577d53aa", "parentcaller": "0x259320cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xafI\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x009]\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00i_\\x9d\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:44:30,969", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "7986" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "9660", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "9660", "caller": "0x7fff577c30ce", "parentcaller": "0x2593220ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "7824" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x000\\xd7\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x005\\xd7\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "2368" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0013c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x000\\xd7\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x005\\xd7\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "2368" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:44:31,126", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x04\\x6df\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x82\\xdc\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xc6\\xdd\\x9f\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00z\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32" }, { "name": "Handle", "value": "0x00000354" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-winrt-string-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff584a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-winrt-string-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "WindowsCreateStringReference" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584e7ac0" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "RoGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584cc1a0" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5854f760" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000360" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xce/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0R\\x18\\xff\\x7f\\x00\\x00\\xa0\\xbdR\\x18\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x90\\xcf/7\\xfc\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0R\\x18" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000364" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000360" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000360" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fd90000" }, { "name": "SectionOffset", "value": "0xfc372fcfb0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae5b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000368" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000368" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000368" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58bd4000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "InitRoutine", "value": "0x7fff58b4d990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000378" }, { "name": "ObjectAttributesName", "value": "ActivatableClassId" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Background.BackgroundExecutionManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000380" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00|\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00E\\x00x\\x00e\\x00c\\x00u\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x008\\xffcc/7\\xfffc\\x00\\x00\\x00\\xffc2_#T\\x10\\xffed\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff9a\\xffe4*Y\\x02\\x00\\x00\\xffd0\\xffe4FAY\\x02\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00``\\xffe3*Y\\x02\\x00\\x00\\xff80\\xffcc/7\\xfffc\\x00\\x00\\x00\\xffe4I0\\x18\\xffff\\x7f\\x00\\x00\\xffd0\\xffe4FAY\\x02\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffx\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0R\\x18\\xffff\\x7f\\x00\\x00\\xffb8\\xffcfR\\x18\\xffff\\x7f\\x00\\x00``\\xffe3*Y\\x02\\x00\\x00\\xfff8\\xff81R\\x18\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00Y\\x02\\x00\\x00h\\xffd0R\\x18\\xffff\\x7f\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0R\\x18\\xffff\\x7f\\x00\\x00p\\xffcc/7\\xfffc\\x00\\x00\\x00\\xff98\\xff85R\\x18\\xffff\\x7f\\x00\\x00\\xff80\\xffcc/7\\xfffc\\x00\\x00\\x00\\xffd0\\x12\\xffe3*Y\\x02\\x00\\x00\\xffb0tOX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x00\\xffce/7\\xfffc\\x00\\x00\\x00``\\xffe3*Y\\x02\\x00\\x00@\\xff9a\\xffe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\xffec\\x12\\xffe3*Y\\x02\\x00\\x000\\x00\\x00\\x00Y\\x02\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\xffcc/7\\xfffc\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P`\\xffe3*Y\\x02\\x00\\x00\\x19hOX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000380" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:44:31,141", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xcd/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00Y\\x02\\x00\\x00!\\xcf/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\xfa\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xf0\\xc5o8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Push Notification Platform" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000043e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc3o8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00>\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x80\\xc4o8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043e" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1497 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5854f195", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000043c" }, { "name": "ValueName", "value": "WaitForRestore" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5854ca47", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae7c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "Handle", "value": "0x00000460" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xb4o8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00~\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xd0\\xb5o8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000047e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" }, { "name": "Handle", "value": "0x00000460" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000047e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d6e85", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000460" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000460" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000460" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10096", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000047e" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7fff00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 10:44:31,204", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000045c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae7e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff50870000" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff50870000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff50886540" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff508865f0" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xc5/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xb0\\xc6/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000046e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xc4/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00@\\xc5/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc2/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00p\\xc3/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000046e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae80000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae81000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc1/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x00\\xc2/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc1/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x00\\xc2/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xc0/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00@\\xc1/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000046e" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff4cbf0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7fff4cbf0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff4cbf7340" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7fff4cbf0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\x0e\\xe6*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xd1\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\x83\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xd8\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xd8\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "hd\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xd2\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00c\\x00:\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00D\\x005\\x000\\x008\\x001\\x00B\\x008\\x008\\x00F\\x002\\x00C\\x00B\\x00F\\x009\\x00A\\x001\\x00A\\x007\\x00B\\x000\\x003\\x002\\x002\\x00C\\x009\\x00F\\x00]\\x00\\x00\\x00" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8\\x8b\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xd3\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc2_c[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xceo8\\xfc\\x00\\x00\\x00x\\xceo8\\xfc\\x00\\x00\\x00H\\xceo8\\xfc\\x00\\x00\\x00h\\xceo8" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xd3\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcco8\\xfc\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 2, "id": 1731 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "WindowsDeleteString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584e7690" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:44:31,219", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xd4/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00^\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x90\\xd5/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000045e" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb1\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffed/8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc0W\\xffea*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffb2\\xffd7\\xffe3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10t\\xffea*Y\\x02\\x00\\x00x\\xffb1\\xffe9*Y\\x02\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffc0W\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00\\xffc0W\\xffea*Y\\x02\\x00\\x00\\x10t\\xffea*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10t\\xffea*Y\\x02\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0W\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc0W\\xffea*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffee/8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0T\\xffea*Y\\x02\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8`\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xdc\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x83\\x19\\xb5\\xdb\\xef\\x9c\\xcc6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\\\xe3*" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8\\x88\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xd0\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xa2Jc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xe0\\xdbo8\\xfc\\x00\\x00\\x00\\xd8\\xdbo8\\xfc\\x00\\x00\\x00\\xa8\\xdbo8\\xfc\\x00\\x00\\x00\\xc8\\xdbo8" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xd0\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xd9o8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "hd\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae83000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae84000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\x87\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x1e\\xe6*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x02Vc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00@\\xd8o8\\xfc\\x00\\x00\\x008\\xd8o8\\xfc\\x00\\x00\\x00\\x08\\xd8o8\\xfc\\x00\\x00\\x00(\\xd8o8" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1e\\xe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xd6o8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 1, "id": 1777 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f530fd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592add2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aea8000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X`\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xda\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00m\\x00s\\x00v\\x00c\\x00p\\x001\\x001\\x000\\x00_\\x00w\\x00i\\x00n\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x86\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xdb\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xdb\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xh\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xd1\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00H\\xc8\\x94\\x19\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00p\\xd4\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\x87\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xd1\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc2_c[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xceo8\\xfc\\x00\\x00\\x00x\\xceo8\\xfc\\x00\\x00\\x00H\\xceo8\\xfc\\x00\\x00\\x00h\\xceo8" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xd1\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcco8\\xfc\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 1, "id": 1809 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xd2\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\xf5W\\x9b\\x1f\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00D\\x005\\x000\\x008\\x001\\x00B\\x008\\x008\\x00F\\x002\\x00C\\x00B\\x00F\\x009\\x00A\\x001\\x00A\\x007\\x00B\\x000\\x003\\x002\\x002\\x00C\\x009\\x00F\\x00]\\x00\\x00\\x00" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\x88\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xd3\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x02Vc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00@\\xd8o8\\xfc\\x00\\x00\\x008\\xd8o8\\xfc\\x00\\x00\\x00\\x08\\xd8o8\\xfc\\x00\\x00\\x00(\\xd8o8" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xd3\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xd6o8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000046e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000486" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 1, "id": 1831 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff58568bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9656" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "capauthz.dll" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59fafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000046c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000484" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00051000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501ea000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aebb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aebc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "WINTRUST.dll" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000048c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aa0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00067000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f64485", "parentcaller": "0x7fff59f688a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000046e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}" }, { "name": "Handle", "value": "0x0000046e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7fff501a0000" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000046e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af16000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5781cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5781cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSASN1.dll" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 10:44:31,235", "thread_id": "10060", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004a0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57130000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000486" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msasn1" }, { "name": "BaseAddress", "value": "0x7fff57130000" }, { "name": "InitRoutine", "value": "0x7fff57135860" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff571357f9", "parentcaller": "0x7fff571356a6", "category": "registry", "api": "RegOpenKeyExA", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff571357f9", "parentcaller": "0x7fff571356a6", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wintrust" }, { "name": "BaseAddress", "value": "0x7fff57aa0000" }, { "name": "InitRoutine", "value": "0x7fff57ab1670" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\capauthz" }, { "name": "BaseAddress", "value": "0x7fff501a0000" }, { "name": "InitRoutine", "value": "0x7fff501d2fd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff46d8f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff46d8f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501a68cd", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501a6915", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0000000e", "pretty_value": "KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501a6ec9", "parentcaller": "0x7fff501ab441", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501ab576", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004aa" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501abca8", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a8" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff501abcde", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff5781026b", "parentcaller": "0x7fff46d39bfa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a4" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08e\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xd5\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x94{\\xa7\\xda\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8\\x8a\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xda\\xe9*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xda\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8g\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x80U\\xe0*Y\\x02\\x00\\x00\\x80U\\xe0*Y\\x02\\x00\\x00\\x80U\\xe0*Y\\x02\\x00\\x00`O\\xe0*Y\\x02\\x00\\x00\\x80U\\xe0*Y\\x02\\x00\\x00\\x80U\\xe0*Y\\x02\\x00\\x00`O\\xe0*" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af17000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xd0\\xe9*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x90\\xc8~\\x95\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc2_c[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xceo8\\xfc\\x00\\x00\\x00x\\xceo8\\xfc\\x00\\x00\\x00H\\xceo8\\xfc\\x00\\x00\\x00h\\xceo8" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xd8\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcco8\\xfc\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2R\\x18" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x97\\x9b\\xa1\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4100b625", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4100b635", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4100b644", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7fff58070000" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58070000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00L\\x00i\\x00m\\x00i\\x00t\\x00e\\x00d\\x00A\\x00c\\x00c\\x00e\\x00s\\x00s\\x00F\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e\\x00s\\x00\"\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc4/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x12\\xfffe\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10w\\xffea*Y\\x02\\x00\\x00x\\xffb3\\xffe9*Y\\x02\\x00\\x00P\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb3\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x10w\\xffea*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10w\\xffea*Y\\x02\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb3\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb3\\xffe9*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc5/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xffea*Y\\x02\\x00\\x00P\\xffb3\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10096", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000480" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\CustomAttributes" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel" }, { "name": "DllBase", "value": "0x7fff457f0000" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7836", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "BaseAddress", "value": "0x7fff457f0000" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff457f0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7836", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d6e85", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501a6ec9", "parentcaller": "0x7fff501ab441", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501ab576", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "Data", "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "CapSids" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "CapSids" }, { "name": "Data", "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501abca8", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff501abcde", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b132e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xf6/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\xe6\tj\\x01\\x00\\x00\\x00r\\xf3n<:\\xf5O\\xa5\\x7fR\\x0eQ" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ddf8a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ddf8a", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff577ddfa1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577dd70a", "parentcaller": "0x7fff577b8db6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2079 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577dd70a", "parentcaller": "0x7fff577b8db6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aebf000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b3d26", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004a4" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b3d37", "parentcaller": "0x7fff577b3354", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fe10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fe10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff577b341d", "parentcaller": "0x7fff577b3f0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10060" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-29 10:44:31,251", "thread_id": "10060", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000480" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KernelBase.dll.mui" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000458" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fe10000" }, { "name": "SectionOffset", "value": "0xfc372fa8e0" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "10088", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" }, { "name": "Handle", "value": "0x000004b6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "10088", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004b6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004a6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f04460" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xb8/7\\xfc\\x00\\x00\\x00\\xb8\\xb8/7\\xfc\\x00\\x00\\x00\\xd0\\xbe\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\xfc\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001Y\\x02\\x00\\x00\\xf8\\x02\\xe8*Y\\x02\\x00\\x00\\xe0\\xbe/7" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "10088", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "10088", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "10088", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00h'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10088" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" }, { "name": "Handle", "value": "0x000004b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004b4" }, { "name": "SubKey", "value": "com.microsoft.windows.taskbar.requestPinSecondaryTile" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "04c19204-10d9-450a-95c4-2910c8f72be3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.CryptographicBuffer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b4" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00B\\x00u\\x00f\\x00f\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffbf/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xff90k\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd2\\xff80\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0w\\xffea*Y\\x02\\x00\\x00\\xfff8\\xffb2\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xff90k\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\xff90k\\xffe9*Y\\x02\\x00\\x00\\xffd0w\\xffea*Y\\x02\\x00\\x00P`\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0w\\xffea*Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90k\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xff90k\\xffe9*Y\\x02\\x00\\x00P`\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc0/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0Y\\xffea*Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType" } ], "repeated": 0, "id": 2146 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath" } ], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel" } ], "repeated": 0, "id": 2150 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004b4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer" } ], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CryptoWinRT" }, { "name": "DllBase", "value": "0x2592ff50000" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "BaseAddress", "value": "0x2592ff50000" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x2592ff50000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2592ff50000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2592ff5f560" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2592ff50000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2592ff58590" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2592ff50000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2592ff55cd0" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.Core.HashAlgorithmNames" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004cc" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00j\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00N\\x00a\\x00m\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffbf/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffe0\\xff85\\xffe4*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc2\\xff80\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\xfff8\\xffbf\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffe0\\xff85\\xffe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00\\xffe0\\xff85\\xffe4*Y\\x02\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\x10Y\\xffea*Y\\x02\\x00\\x00\\x10Y\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xff85\\xffe4*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10Y\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffe0\\xff85\\xffe4*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffc0/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath" } ], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004cc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.Core.HashAlgorithmProvider" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004cc" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb5\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffbf/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffb0~\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd2\\xff80\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00x\\xffb5\\xffe9*Y\\x02\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffb0~\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00\\xffb0~\\xffe9*Y\\x02\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00`i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\xfff0Y\\xffea*Y\\x02\\x00\\x00\\xfff0Y\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0~\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0Y\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffb0~\\xffe9*Y\\x02\\x00\\x00`i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc0/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`S\\xffea*Y\\x02\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server" } ], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading" } ], "repeated": 0, "id": 2185 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004cc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer" } ], "repeated": 0, "id": 2188 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-29 10:44:31,266", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004cc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f04460" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Expiration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Core.CoreApplication" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\xfff5Y(\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc2/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x12\\xfffc\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00x\\xffbf\\xffe9*Y\\x02\\x00\\x00P\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffbf\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x10i\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\\\xffea*Y\\x02\\x00\\x00P\\xffbf\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType" } ], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes" } ], "repeated": 0, "id": 2206 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:25b81dcef5820d74a00" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-29 10:44:31,282", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-29 10:44:31,376", "thread_id": "9788", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9788" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-29 10:44:31,876", "thread_id": "9760", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ca5d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-29 10:44:31,876", "thread_id": "9760", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592caee000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-29 10:44:31,876", "thread_id": "9760", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592caf0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-29 10:44:31,876", "thread_id": "9760", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592cae5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-29 10:44:31,876", "thread_id": "9760", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592cd02000" }, { "name": "RegionSize", "value": "0x000fe000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff5181f406", "parentcaller": "0x7fff517e0733", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.PropertySet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb5\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffec_8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc2\\xffd5\\xff93\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00x\\xffb5\\xffe9*Y\\x02\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\xff90a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90p\\xffea*Y\\x02\\x00\\x00\\xfff0R\\xffea*Y\\x02\\x00\\x00\\xfff0R\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0R\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb2\\xffe9*Y\\x02\\x00\\x00\\xff90a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffed_8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10Y\\xffea*Y\\x02\\x00\\x00P\\xffb5\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType" } ], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52dc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dc9590" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dc90f0" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dd47b0" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52efd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52efd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff517e91f4", "parentcaller": "0x7fff517e8d56", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff517e926f", "parentcaller": "0x7fff517e8d56", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff517e1c1b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff517e1d43", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff517e1dc0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff517e3b54", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5180dff2", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577ced78", "parentcaller": "0x7fff517e1eea", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff517fa9cc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff517e2239", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff517e2239", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff517e2239", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff517e2239", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d6785", "parentcaller": "0x7fff518214d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d6785", "parentcaller": "0x7fff518214d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff518257fb", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d6785", "parentcaller": "0x7fff518214d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2266 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\XAML" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5182154d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d4" }, { "name": "ValueName", "value": "OneCoreTransformsEnabledByDefault" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5182154d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10092", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x25947490000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x25947490000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004b4" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xc1\\xe7*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2277 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:25b81dcef5820d74a00" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "DesiredAccess", "value": "0x000f0007", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE" }, { "name": "ObjectAttributes", "value": "ApplicationService:25b81dcef5820d74a00" }, { "name": "FileHandle", "value": "0x00000000" }, { "name": "FileName", "value": "" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffc0000" }, { "name": "SectionOffset", "value": "0xfc372fc990" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffc0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.PropertyValue" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00V\\x00a\\x00l\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff87\\x167\\xfffc\\x00\\x00\\x00\\x00\\x00\n\\x00.\\x00\\x00\\x00\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xffe8-\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc2/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffda\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00B\\xfffc\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0~\\xffea*Y\\x02\\x00\\x00\\xffe8-\\xffe6*Y\\x02\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffda\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\xffd0\\xffda\\xffe9*Y\\x02\\x00\\x00\\xffd0~\\xffea*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0~\\xffea*Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffda\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffda\\xffe9*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc3/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.UI.StartScreen.SecondaryTile" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00H\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff87\\x167\\xfffc\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xfff6\\x7f\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00h&\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc6/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffe2\\xffff\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0y\\xffea*Y\\x02\\x00\\x00h&\\xffe6*Y\\x02\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\xffd0y\\xffea*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0y\\xffea*Y\\x02\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0]\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x10R\\xffea*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc7/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x167\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00\\xbc%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Tiles.SecondaryTileStore" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00p\\x00P\\x002\\x00\\x00\\x00\\xfffc\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00:\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffef/8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x12\\xffd1\\xffe3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00\\xffa0e\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00\\xffa01\\xffe6*Y\\x02\\x00\\x00\\xffa01\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa01\\xffe6*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc0-\\xffe6*Y\\x02\\x00\\x00\\xffa0e\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xfff0/8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 <\\xffe6*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7fff58070000" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58070000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff58070000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x2592ae9d890", "arguments": [ { "name": "CommandLine", "value": "prog --profile-directory=Default" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00p+\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x10,\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x000,\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00D-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00X-\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00`-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80-\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x88-\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8-\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00`,\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xe6,\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xec,\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x167\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00\\xbc%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00h'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10088" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004dc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xdd\\xae\\xc1\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Background.BackgroundTaskRegistration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004e0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "10088", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 10:44:33,344", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepository" }, { "name": "DllBase", "value": "0x7fff4b840000" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\TileDataRepository" }, { "name": "DllBase", "value": "0x7fff43150000" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "BaseAddress", "value": "0x7fff43150000" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff43150000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "TileDataRepository.dll" }, { "name": "ModuleHandle", "value": "0x7fff43150000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff4316cbe0" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "TileDataRepository.dll" }, { "name": "ModuleHandle", "value": "0x7fff43150000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff4315cfe0" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "TileDataRepository.dll" }, { "name": "ModuleHandle", "value": "0x7fff43150000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43151270" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff4316ab6e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 1, "id": 2375 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\biwinrt" }, { "name": "DllBase", "value": "0x7fff3d7b0000" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff5781026b", "parentcaller": "0x7fff4317e80f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004e4" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5781026b", "parentcaller": "0x7fff4317e80f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004dc" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff431766f7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff431e5000" }, { "name": "ModuleName", "value": "TileDataRepository.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff431e5000" }, { "name": "ModuleName", "value": "TileDataRepository.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.System.Internal.UserManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "KeyInformation", "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00F\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00:\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe6O8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffa2\\xffdf\\xff83\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10~\\xffe6*Y\\x02\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\x10~\\xffe6*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10~\\xffe6*Y\\x02\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p]\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00@T\\xffea*Y\\x02\\x00\\x00\\xffe0a\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe7O8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0R\\xffea*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\biwinrt.dll" }, { "name": "BaseAddress", "value": "0x7fff3d7b0000" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d7b0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\biwinrt.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateAsUser" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000444" }, { "name": "ObjectAttributesName", "value": "UserManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000444" }, { "name": "ObjectAttributesName", "value": "UserManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0CzX\\xffff\\x7f\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe7/8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x10o\\xffe3*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\xffd9\\xffe3\\xfffc\\x12\\xffbc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x10o\\xffe3*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x10o\\xffe3*Y\\x02\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P^\\xffea*Y\\x02\\x00\\x00kjNX\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc8\\xffe8/8\\xfffc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Py\\xffea*Y\\x02\\x00\\x00\\xffc0^\\xffea*Y\\x02\\x00\\x00\\xffc0^\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10o\\xffe3*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0^\\xffea*Y\\x02\\x00\\x00\\xffe3rNX\\xffff\\x7f\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00k\\xff89YX\\xffff\\x7f\\x00\\x00\\xffd8\\xffbarX\\xffff\\x7f\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x008\\xffe8/8\\xfffc\\x00\\x00\\x00\\x01~NX\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffaeVX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000504" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Background.BackgroundWorkManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004fc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae86000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000500" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000504" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\CustomAttributes" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aec7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000502" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004da" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004da" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004da" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ee" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fe" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fe" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fe" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000506" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xbcO8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xda\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00P\\xbdO8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004da" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004da" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000504" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000508" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xbaO8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xda\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x80\\xbbO8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\x88\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004da" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8k\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xa2Jc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xe0\\xdbo8\\xfc\\x00\\x00\\x00\\xd8\\xdbo8\\xfc\\x00\\x00\\x00\\xa8\\xdbo8\\xfc\\x00\\x00\\x00\\xc8\\xdbo8" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000k\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xd9o8\\xfc\\x00\\x00\\x00\\x08\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x89\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98k\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbf/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xb0\\xc0/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x02Vc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00@\\xd8o8\\xfc\\x00\\x00\\x008\\xd8o8\\xfc\\x00\\x00\\x00\\x08\\xd8o8\\xfc\\x00\\x00\\x00(\\xd8o8" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ee" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fe" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}" }, { "name": "Handle", "value": "0x0000050a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fe" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fe" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff584d855f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fe" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000506" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000506" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000506" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xbd/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xc0\\xbe/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004da" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "hn\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00u\\x00s\\x00e\\x00r\\x00m\\x00g\\x00r\\x00p\\x00r\\x00o\\x00x\\x00y\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004fe" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004fe" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x8c\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbd/8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xb0\\xbe/8\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004da" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ee" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff50f81000" }, { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000506" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\usermgrproxy" }, { "name": "DllBase", "value": "0x7fff4f6e0000" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "BaseAddress", "value": "0x7fff4f6e0000" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff4f6e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10060", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff597c53ea", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597c6764", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004fc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004fc" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x07\\x197\\xfffc\\x00\\x00\\x00,\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00h&\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffddo8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xff93\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xfff2\\xffe6\\xffa3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00h&\\xffe6*Y\\x02\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xff93\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00\\xffd0\\xff93\\xffec*Y\\x02\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00\\xff90k\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00`\\xff9a\\xffec*Y\\x02\\x00\\x00`\\xff9a\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff93\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xff9a\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xff93\\xffec*Y\\x02\\x00\\x00\\xff90k\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffdeo8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff99\\xffec*Y\\x02\\x00\\x00@&\\xffe6*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004fc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004fc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 10:44:33,360", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004fc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff52de1f48", "parentcaller": "0x7fff52de26b1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d7ff000" }, { "name": "ModuleName", "value": "biwinrt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d7ff000" }, { "name": "ModuleName", "value": "biwinrt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataReader" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00R\\x00e\\x00a\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00P\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00>\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffd8o8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffb2\\xffea\\xffa3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10f\\xffe3*Y\\x02\\x00\\x00\\xfff8\\xffbf\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00\\x10f\\xffe3*Y\\x02\\x00\\x00\\xff80l\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10f\\xffe3*Y\\x02\\x00\\x00\\xffa0\\xff91\\xffec*Y\\x02\\x00\\x00\\xffa0\\xff91\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff91\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00\\xff80l\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffd9o8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff98\\xffec*Y\\x02\\x00\\x00\\xffd0\\xffbf\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000048c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000048c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000048c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000048c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592af0a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4315dc24", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4315dc24", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae87000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aecd000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae88000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 1, "id": 2624 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2625 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000004ec" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff577d6785", "parentcaller": "0x7fff431516e6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c697", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000048c" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c717", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\x89\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00R\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98k\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@h\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\xc0pd\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\x86\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8b\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0b\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88l\\xea*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00f\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\x86\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xf\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc2_c[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xceo8\\xfc\\x00\\x00\\x00x\\xceo8\\xfc\\x00\\x00\\x00H\\xceo8\\xfc\\x00\\x00\\x00h\\xceo8" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pf\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcco8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 1, "id": 2658 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000514" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.SecondaryTileView" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000514" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffc7\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffeb/8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00`5\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00B\\xffd5\\xffe3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00x\\xffc7\\xffe9*Y\\x02\\x00\\x00P\\xffc7\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00`5\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc7\\xffe9*Y\\x02\\x00\\x00`5\\xffec*Y\\x02\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00\\xff90k\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x7f\\xffe6*Y\\x02\\x00\\x00\\xff90\\xff9c\\xffec*Y\\x02\\x00\\x00\\xff90\\xff9c\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`5\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff9c\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00`5\\xffec*Y\\x02\\x00\\x00\\xff90k\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffec/8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff94\\xffec*Y\\x02\\x00\\x00P\\xffc7\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xd4o8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xee\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xd5o8\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00l\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x03\\x00\\x00\\x08\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\x18\\xe8*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0g\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xd9o8\\xfc\\x00\\x00\\x00\\xec\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2R\\x18" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\x8e\\xe9*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x1e\\xe6*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x02Vc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00@\\xd8o8\\xfc\\x00\\x00\\x008\\xd8o8\\xfc\\x00\\x00\\x00\\x08\\xd8o8\\xfc\\x00\\x00\\x00(\\xd8o8" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1e\\xe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xd6o8\\xfc\\x00\\x00\\x00\\xec\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 1, "id": 2688 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ee" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000004ec" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000048c" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xe7\\xec*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@h\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\xc0pd\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" }, { "name": "Handle", "value": "0x00000516" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xl\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pl\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xe5\\xec*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00o\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\xf1\\xec*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000516" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000516" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000514" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Application" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000514" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00X\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffc2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffeb/8\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffc6\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00B\\xffd5\\xffe3\\xfffc\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x05\\xffed*Y\\x02\\x00\\x00x\\xffc2\\xffe9*Y\\x02\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffc6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffc6\\xffe9*Y\\x02\\x00\\x00\\x10\\x05\\xffed*Y\\x02\\x00\\x00`\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x05\\xffed*Y\\x02\\x00\\x000_\\xffea*Y\\x02\\x00\\x000_\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000_\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffc6\\xffe9*Y\\x02\\x00\\x00`\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffec/8\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00PW\\xffea*Y\\x02\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000514" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004de" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" }, { "name": "Handle", "value": "0x00000516" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004de" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004de" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000516" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000516" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004dc" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xe4\\xec*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`l\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\xf1\\xec*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98n\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00bPc[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00 \\xd2o8\\xfc\\x00\\x00\\x00\\x18\\xd2o8\\xfc\\x00\\x00\\x00\\xe8\\xd1o8\\xfc\\x00\\x00\\x00\\x08\\xd2o8" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90n\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd0o8\\xfc\\x00\\x00\\x00\\xdc\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd7\\x05\\x15\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x1f\\x05\\x15\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xe9\\xec*Y\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0m\\xec*Y\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x03\\x00\\x00\\x08\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x17\\xe8*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "x\\xf4\\xec*Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8n\\xec*Y\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc2_c[\\x10\\xed\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xceo8\\xfc\\x00\\x00\\x00x\\xceo8\\xfc\\x00\\x00\\x00H\\xceo8\\xfc\\x00\\x00\\x00h\\xceo8" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0n\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcco8\\xfc\\x00\\x00\\x00\\xdc\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 1, "id": 2770 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "WindowsGetStringRawBuffer" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584f2340" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 1, "id": 2772 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" }, { "name": "Handle", "value": "0x00000516" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xfb\\x1e\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb2\\x1f\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00A\"\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x06$\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "2868" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0010a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" }, { "name": "Handle", "value": "0x000004e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x86&\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xcf'\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c00041000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10032", "caller": "0x7fff577d5810", "parentcaller": "0x259320cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xcf'\\xc2\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 1, "id": 2801 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" }, { "name": "Handle", "value": "0x000004e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff58568bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9656" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000048c" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00 E\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xc0E\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0E\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xf4F\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08G\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x10G\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000G\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x008G\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00XG\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x10F\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x96F\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x9cF\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf0<\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x90=\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0=\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xc4>\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8>\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xe0>\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00?\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08?\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(?\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xe0=\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00f>\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00l>\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000516" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004ee" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10096", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004da" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ee" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000516" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10060", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10060" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 10:44:33,376", "thread_id": "10088", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00h'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10088" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10096", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10096", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00p'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10096" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10060" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000004d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2592aed0250" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "3388" }, { "name": "ProcessId", "value": "9656" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000004d8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2592aed0250" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3388" }, { "name": "ProcessId", "value": "9656" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae8d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae8f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800226000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2592aed0250" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "3388", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Shell.TaskbarManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00:\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffce/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00P`\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffa2\\xfff7\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pq\\xffea*Y\\x02\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00P`\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00P`\\xffec*Y\\x02\\x00\\x00Pq\\xffea*Y\\x02\\x00\\x00 \\xffe3\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pq\\xffea*Y\\x02\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P`\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00P`\\xffec*Y\\x02\\x00\\x00 \\xffe3\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcf/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.TaskbarPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffcd/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffa07\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffb2\\xfff7\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10u\\xffea*Y\\x02\\x00\\x00\\xfff8\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffa07\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00\\xffa07\\xffec*Y\\x02\\x00\\x00\\x10u\\xffea*Y\\x02\\x00\\x00\\xffd0\\xffe7\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10u\\xffea*Y\\x02\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa07\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff92\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffa07\\xffec*Y\\x02\\x00\\x00\\xffd0\\xffe7\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffce/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\xffd0\\xffbe\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dxgi" }, { "name": "DllBase", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\d3d11" }, { "name": "DllBase", "value": "0x7fff53070000" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WININET" }, { "name": "DllBase", "value": "0x7fff48b40000" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 10:44:33,391", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 26, "id": 2888 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker" }, { "name": "DllBase", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "BaseAddress", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d6a0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6e1860" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6c2a90" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6c03b0" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "10092", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000534" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9292", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ae95000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9292", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0800228000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9292", "caller": "0x7fff577f4448", "parentcaller": "0x259312ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xd0c0005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9292", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9292", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x2592ae02340" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" }, { "name": "Handle", "value": "0x0000053a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000053a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000053e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000053a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xad/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x00\\xae/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 10:44:33,407", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000053a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000053e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xab/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x90\\xac/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xab/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x90\\xac/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000053a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xa9/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\xc0\\xaa/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000053a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000053e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xa8/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00P\\xa9/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xa8/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00P\\xa9/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000053a" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xa7/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x90\\xa8/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000053e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000053e" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000053a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000053a" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff43060000" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff43060000" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff43060000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43061660" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff430616a0" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9292", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000540" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf0<\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x90=\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0=\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xc4>\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8>\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xe0>\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00?\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08?\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(?\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xe0=\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00f>\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00l>\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.UI.StartScreen.StartScreenManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffc2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc5/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00R\\xffff\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x02\\xffed*Y\\x02\\x00\\x00x\\xffc2\\xffe9*Y\\x02\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffb6\\xffe9*Y\\x02\\x00\\x00\\xff90\\x02\\xffed*Y\\x02\\x00\\x00\\x10\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x02\\xffed*Y\\x02\\x00\\x00\\xfff0\\xff92\\xffec*Y\\x02\\x00\\x00\\xfff0\\xff92\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff92\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffd0\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x10\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc6/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff94\\xffec*Y\\x02\\x00\\x00P\\xffc2\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000054c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "3388", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000550" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.System.User" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000550" }, { "name": "KeyInformation", "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00&\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc5/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x000\\xffe7\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x12\\xffff\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x03\\xffed*Y\\x02\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x000\\xffe7\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x000\\xffe7\\xffec*Y\\x02\\x00\\x00\\xff90\\x03\\xffed*Y\\x02\\x00\\x00\\x10\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x03\\xffed*Y\\x02\\x00\\x00p6\\xffe6*Y\\x02\\x00\\x00p6\\xffe6*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe7\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p6\\xffe6*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x000\\xffe7\\xffec*Y\\x02\\x00\\x00\\x10\\xffe4\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc6/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 <\\xffe6*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000550" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0xfc00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000550" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" }, { "name": "Handle", "value": "0x00000552" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000552" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000556" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000556" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000556" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000552" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 10:44:33,422", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" }, { "name": "Handle", "value": "0x0000054e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000556" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000556" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000556" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9292", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" }, { "name": "Handle", "value": "0x00000552" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000552" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000552" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000528" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Tiles.TileStore" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000528" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffc5/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x000\\xff85\\xffed*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xffc2\\xfffe\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x02\\xffed*Y\\x02\\x00\\x00x\\xffb6\\xffe9*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x000\\xff85\\xffed*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x000\\xff85\\xffed*Y\\x02\\x00\\x00\\xffd0\\x02\\xffed*Y\\x02\\x00\\x00\\x00\\xffea\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x02\\xffed*Y\\x02\\x00\\x00\\xffc0P\\xffea*Y\\x02\\x00\\x00\\xffc0P\\xffea*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff85\\xffed*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0P\\xffea*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x000\\xff85\\xffed*Y\\x02\\x00\\x00\\x00\\xffea\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffc6/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 U\\xffea*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000528" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\x89\\xe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.TileView" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000568" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xffff\\x7f\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffca\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc1/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xfff2\\xff82\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00x\\xffca\\xffe9*Y\\x02\\x00\\x00P\\xffca\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffca\\xffe9*Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00\\x00\\xffea\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00P\\xffb6\\xffe9*Y\\x02\\x00\\x00\\x00\\xffea\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc2/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff95\\xffec*Y\\x02\\x00\\x00P\\xffca\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000568" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000568" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000052a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000053a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-29 10:44:33,438", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x00000528" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aed9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aedb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000528" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:25b81dcef5820d74a00" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000528" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffd0000" }, { "name": "SectionOffset", "value": "0xfc372fcc10" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f700000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f703000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffd0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f702000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aeda000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "MutexName", "value": "Local\\SM0:9656:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000538" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000538" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000528" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000528" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00l\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffca\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffc4/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00@F\\xffec*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00b\\xfffe\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00\\xfff8\\xffca\\xffe9*Y\\x02\\x00\\x00\\xffd0\\xffca\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00@F\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffca\\xffe9*Y\\x02\\x00\\x00@F\\xffec*Y\\x02\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00\\xfff0\\xffe0\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\x04\\xffed*Y\\x02\\x00\\x00@\\xff9b\\xffec*Y\\x02\\x00\\x00@\\xff9b\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@F\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff9b\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00@F\\xffec*Y\\x02\\x00\\x00\\xfff0\\xffe0\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffc5/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff9a\\xffec*Y\\x02\\x00\\x00\\xffd0\\xffca\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000528" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3212 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Bcp47Langs" }, { "name": "DllBase", "value": "0x7fff4c520000" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-29 10:44:33,454", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StartTileData" }, { "name": "DllBase", "value": "0x7fff43dd0000" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "BaseAddress", "value": "0x7fff43dd0000" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff43dd0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43ea7f30" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43e82270" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43e9a890" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x0000058c" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000058c" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000058c" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc9/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000058c" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aef0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf7t\\xc3\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00M\\xe8*Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0M\\xe8*Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0M\\xe8*Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4N\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8N\\xe8*Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0N\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10O\\xe8*Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18O\\xe8*Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008O\\xe8*Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0M\\xe8*Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vN\\xe8*Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|N\\xe8*Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "3388", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "3388", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aedc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3270 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xf4\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x00000590" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000590" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:25b81dcef5820d74a00" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000590" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffd0000" }, { "name": "SectionOffset", "value": "0xfc372fcc10" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f703000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffd0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f702000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000590" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000590" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-29 10:44:33,469", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000590" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc9/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001474" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf7\\xa0\\xc3\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000598" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.ApplicationData" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000598" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffb1\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffca/7\\xfffc\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xfff0\\xffd5\\xffee*Y\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00R\\xfff4\\xffe3\\xfff3\\x12\\xffbc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pr\\xffee*Y\\x02\\x00\\x00x\\xffb1\\xffe9*Y\\x02\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xfff0\\xffd5\\xffee*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00\\xfff0\\xffd5\\xffee*Y\\x02\\x00\\x00Pr\\xffee*Y\\x02\\x00\\x00\\x10\\xfff4\\xffee*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pr\\xffee*Y\\x02\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffd5\\xffee*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffec*Y\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\xfff0\\xffd5\\xffee*Y\\x02\\x00\\x00\\x10\\xfff4\\xffee*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffcb/7\\xfffc\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff94\\xffec*Y\\x02\\x00\\x00P\\xffb1\\xffe9*Y\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel" } ], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000598" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000598" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData" }, { "name": "DllBase", "value": "0x7fff3d810000" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "BaseAddress", "value": "0x7fff3d810000" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d810000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d834340" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d8220a0" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d8240a0" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "3388", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "3388", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "3388", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "3388", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "3388", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd4/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00Y\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" }, { "name": "MutexName", "value": "Local\\SM0:9656:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a0" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x0000059c" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER" }, { "name": "ObjectAttributes", "value": "HKEY_USERS" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "WnfStateName" }, { "name": "Data", "value": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3390 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3395 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000590" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000590" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffd0000" }, { "name": "SectionOffset", "value": "0xfc372fc9a0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "NoPropertiesMyComputer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "NoPropertiesRecycleBin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aede000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "MutexName", "value": "Local\\SM0:9656:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-29 10:44:33,485", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "NoControlPanel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "NoSetFolders" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "NoInternetIcon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3469 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3474 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "ValueName", "value": "NoCommonGroups" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-29 10:44:33,501", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x000005ba" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ba" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ba" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ba" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ba" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "1581568" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ba" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x000005b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3505 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3508 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3510 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlAreLongPathsEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc5280" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-29 10:44:33,516", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59307000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59307000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000005ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 3526 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-29 10:44:33,532", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" }, { "name": "MutexName", "value": "Local\\SM0:9656:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-29 10:44:33,547", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005b0" } ], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3545 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005b2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 3549 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005b2" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000005ba" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc3/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xba\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x80\\xc4/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005ba" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005be" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc3/7\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xbe\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\x00\\x00\\x00\\x80\\xc4/7\\xfc\\x00\\x00\\x00" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005be" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b2" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ba" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005be" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-29 10:44:33,563", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7fff558267d0" }, { "name": "EventName", "value": "Global\\WSearchMigPluginActive" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x167\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00\\xbc%\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9660" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10060" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 3576 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mssprxy.dll" }, { "name": "BaseAddress", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff558d8e8e", "parentcaller": "0x7fff558df5f2", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7D096C5F-AC08-4F1F-BEB7-5C22C517CE39" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "AB310581-AC80-11D1-8DF3-00C04FB6EF69" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005ce" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ce" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ce" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003aa" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" }, { "name": "Handle", "value": "0x000005c6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005c6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c6" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "10060", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x187\\xfc\\x00\\x00\\x00\\xb8%\\x00\\x00\\x00\\x00\\x00\\x00L'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10060" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-29 10:44:33,579", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7fff52860000" } ], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f704000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aef4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592aef5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005b0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592ffe0000" }, { "name": "SectionOffset", "value": "0xfc372fbb30" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c4" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x25947590000" }, { "name": "SectionOffset", "value": "0xfc372fca90" }, { "name": "ViewSize", "value": "0x00049000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3621 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592fff0000" }, { "name": "SectionOffset", "value": "0xfc372fbbe0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x259475e0000" }, { "name": "SectionOffset", "value": "0xfc372fcb40" }, { "name": "ViewSize", "value": "0x0009c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3629 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f706000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90_p/Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000`p/Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P`p/Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00dap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00xap/Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80ap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0ap/Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8ap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8ap/Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80`p/Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06ap/Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0cap/Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90_p/Y\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000`p/Y\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P`p/Y\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00dap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00xap/Y\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80ap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0ap/Y\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8ap/Y\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8ap/Y\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80`p/Y\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06ap/Y\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0cap/Y\\x02\\x00\\x00" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xf6\\xec*Y\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000005d0" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d0" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3645 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3650 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d8" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3657 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005dc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3663 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005dc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2592f709000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-29 10:44:33,594", "thread_id": "9660", "caller": "0x7ff6c768b649", "parentcaller": "0x7ff6c7744f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005dc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "P\\xbc/7\\xfc\\x00\\x00\\x00\\x80\\xbc/7\\xfc\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff5\\x8b\\x02\\xf0\\x01>\\x02\\x00\\x00\\x00\\x00h\\x00\\x00\\x00D\\x0e>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x02@\\x0e>\\x02h\\xf5+\\x05L\\xf5+\\x05\\x1e^~w\\xac\\xf5+\\x05\\x1e^~w\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0292b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x76f115da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:44:50,346", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f594c0" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x6aebc763", "parentcaller": "0x6aef55fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x76650000" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x6aebc763", "parentcaller": "0x6aef55fa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoRegisterClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ef1610" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\TreatAs" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x76f0fc40", "parentcaller": "0x76f0fbf0", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000037c" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Update3COMClass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocServer32" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocHandler32" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000037c" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocHandler" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774a040b", "parentcaller": "0x76f0f9ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774adb61", "parentcaller": "0x76f1313f", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774a964f", "parentcaller": "0x76f1251f", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.5932" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774a964f", "parentcaller": "0x774ac93d", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0292d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0292e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000388" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000038c" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000038c" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc4\\x1c\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00N\\x00T\\x00A\\x00S\\x00N\\x001\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "he\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00m\\x00p\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "|\\xff\\x8f\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd4\\xaa\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xd0\\xaa\\x8d\\x02\\x00\\x00#\\x00T\\xecH\\xec\\x8c\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x8c\\x03\\x00\\x00\\x9c\\xec+\\x05\\xb3\\x91\\x7fw\\x8c\\x03\\x00\\x00" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j,H\\xaf\\xc4D\\xe7+\\x05\\x8c\\x03\\x00\\x00\\xf8\\xf5+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xffT\\xec+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x94\\x1a\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00U\\x00s\\x00e\\x00r\\x00\\\\x00S\\x00-\\x001\\x00-\\x005\\x00-\\x001\\x008\\x00_\\x00C\\x00l\\x00a\\x00s\\x00s\\x00e\\x00s\\x00\\x00\\x00s\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb8d\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00f\\x00t\\x00w\\x00a\\x00r\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x94\\x02\\x90\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\xac\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x80\\xac\\x8d\\x02\\x00\\x00#\\x00<\\xea0\\xea\\x8c\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x8c\\x03\\x00\\x00\\x84\\xea+\\x05\\xb3\\x91\\x7fw\\x8c\\x03\\x00\\x00" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xc4M\\xaf\\xc4,\\xe5+\\x05\\x8c\\x03\\x00\\x00\\xf8\\xf5+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff<\\xea+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x76f10dc9", "parentcaller": "0x76f10cfc", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774adb61", "parentcaller": "0x76f10d93", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76e80000" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000390" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x76fac5b0" }, { "name": "Parameter", "value": "0x02924580" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10272" }, { "name": "ProcessId", "value": "5932" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000390", "arguments": [ { "name": "StartRoutine", "value": "0x76fac5b0" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "Parameter", "value": "0x02924580" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10272" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x76f10d30", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000390" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x94\\x1a\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00U\\x00s\\x00e\\x00r\\x00\\\\x00S\\x00-\\x001\\x00-\\x005\\x00-\\x001\\x008\\x00_\\x00C\\x00l\\x00a\\x00s\\x00s\\x00e\\x00s\\x00\\x00\\x00s\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf8a\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00e\\x00n\\x00t\\x00C\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00S\\x00e\\x00t\\x00\\\\x00S\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00T\\x00P\\x00M\\x00\\x00\\x00" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "T\\xf8\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\xac\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x80\\xac\\x8d\\x02\\x00\\x00#\\x00t\\xefh\\xef\\x98\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x98\\x03\\x00\\x00\\xbc\\xef+\\x05\\xb3\\x91\\x7fw\\x98\\x03\\x00\\x00" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x0cK\\xaf\\xc4d\\xea+\\x05\\x98\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xfft\\xef+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x14\\x1d\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00W\\x00O\\x00W\\x006\\x004\\x00\\\\x00p\\x00r\\x00o\\x00f\\x00a\\x00p\\x00i\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb8d\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00f\\x00t\\x00w\\x00a\\x00r\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "l\\xf8\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "4\\xa5\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x000\\xa5\\x8d\\x02\\x00\\x00#\\x00\\\\xedP\\xed\\x98\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x98\\x03\\x00\\x00\\xa4\\xed+\\x05\\xb3\\x91\\x7fw\\x98\\x03\\x00\\x00" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10272", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02930000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02931000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000390" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "T\\x19\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00\\\\x00O\\x00I\\x00D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb8d\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00f\\x00t\\x00w\\x00a\\x00r\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe4\\xf5\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x0c\\xa6\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x08\\xa6\\x8d\\x02\\x00\\x00#\\x00t\\xefh\\xef\\x90\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x90\\x03\\x00\\x00\\xbc\\xef+\\x05\\xb3\\x91\\x7fw\\x90\\x03\\x00\\x00" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x0cK\\xaf\\xc4d\\xea+\\x05\\x90\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xfft\\xef+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x94\\x1a\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00U\\x00s\\x00e\\x00r\\x00\\\\x00S\\x00-\\x001\\x00-\\x005\\x00-\\x001\\x008\\x00_\\x00C\\x00l\\x00a\\x00s\\x00s\\x00e\\x00s\\x00\\x00\\x00s\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf0`\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00f\\x00t\\x00w\\x00a\\x00r\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x0c\\xf8\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\xac\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x80\\xac\\x8d\\x02\\x00\\x00#\\x00\\\\xedP\\xed\\x90\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x90\\x03\\x00\\x00\\xa4\\xed+\\x05\\xb3\\x91\\x7fw\\x90\\x03\\x00\\x00" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j$I\\xaf\\xc4L\\xe8+\\x05\\x90\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\\\xed+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000390" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc4\\x1c\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00N\\x00T\\x00A\\x00S\\x00N\\x001\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x08d\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00o\\x00g\\x00.\\x00e\\x00x\\x00e\\x00 \\x00/\\x00r\\x00e\\x00c\\x00o\\x00v\\x00e\\x00r\\x00 \\x00r\\x00e\\x00p\\x00a\\x00i\\x00r\\x00f\\x00i\\x00l\\x00e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd4\\xf6\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x0c\\xa6\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x08\\xa6\\x8d\\x02\\x00\\x00#\\x00t\\xefh\\xef\\x98\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x98\\x03\\x00\\x00\\xbc\\xef+\\x05\\xb3\\x91\\x7fw\\x98\\x03\\x00\\x00" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x0cK\\xaf\\xc4d\\xea+\\x05\\x98\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xfft\\xef+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x14\\x1d\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00W\\x00O\\x00W\\x006\\x004\\x00\\\\x00p\\x00r\\x00o\\x00f\\x00a\\x00p\\x00i\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "Xc\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00N\\x00e\\x00t\\x00A\\x00p\\x00i\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00s\\x00" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x94\\xf7\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\xac\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x80\\xac\\x8d\\x02\\x00\\x00#\\x00\\\\xedP\\xed\\x98\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x98\\x03\\x00\\x00\\xa4\\xed+\\x05\\xb3\\x91\\x7fw\\x98\\x03\\x00\\x00" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j$I\\xaf\\xc4L\\xe8+\\x05\\x98\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\\\xed+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000390" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "4\\x1b\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb0/\\x8c\\x02\\x88\\x9d\\x8c\\x02\\xc8R\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb8'\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf0`\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00f\\x00t\\x00w\\x00a\\x00r\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "T\\xf8\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xbc\\xa7\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xb8\\xa7\\x8d\\x02\\x00\\x00#\\x00t\\xefh\\xef\\x90\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x90\\x03\\x00\\x00\\xbc\\xef+\\x05\\xb3\\x91\\x7fw\\x90\\x03\\x00\\x00" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x0cK\\xaf\\xc4d\\xea+\\x05\\x90\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xfft\\xef+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x94\\x1a\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00U\\x00s\\x00e\\x00r\\x00\\\\x00S\\x00-\\x001\\x00-\\x005\\x00-\\x001\\x008\\x00_\\x00C\\x00l\\x00a\\x00s\\x00s\\x00e\\x00s\\x00\\x00\\x00s\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10e\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00I\\x00K\\x00C\\x00e\\x00r\\x00t\\x00E\\x00n\\x00r\\x00o\\x00l\\x00l\\x00-\\x00E\\x00X\\x00C\\x00L\\x00U\\x00S\\x00I\\x00V\\x00E\\x00\\x00\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x14\\xf9\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x84\\xac\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x80\\xac\\x8d\\x02\\x00\\x00#\\x00\\\\xedP\\xed\\x90\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x90\\x03\\x00\\x00\\xa4\\xed+\\x05\\xb3\\x91\\x7fw\\x90\\x03\\x00\\x00" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j$I\\xaf\\xc4L\\xe8+\\x05\\x90\\x03\\x00\\x00\\x8c\\xf9+\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\\\xed+\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x76f12b44", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02933000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02934000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x774b9924", "parentcaller": "0x766ec2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000398" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02935000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000003ac" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003b0" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "4\\x1b\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb0/\\x8c\\x02\\x88\\x9d\\x8c\\x02\\xc8R\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb8'\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\xb0/\\x8c\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x88^\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00m\\x00s\\x00v\\x00c\\x00p\\x001\\x001\\x000\\x00_\\x00w\\x00i\\x00n\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00s\\x00" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf4\\xf7\\x92\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe4\\xa6\\x8d\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xe0\\xa6\\x8d\\x02\\x00\\x00#\\x00d\\xedX\\xed\\xb0\\x03\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\xb0\\x03\\x00\\x00\\xac\\xed+\\x05\\xb3\\x91\\x7fw\\xb0\\x03\\x00\\x00" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:44:50,362", "thread_id": "10256", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\x0c\\xfdy\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x02\\xffcc\\x01>\\x02\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xff9c\n>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xff98\n>\\x02\\xffe8\\xffaay\\x03\\xffb4\\xffdd_\\x05\\x1e^~w\\x01\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd8\\xff9f\\xff8e\\x02\\xffd8\\xff9f\\xff8e\\x02\\x05\\x00\\x00\\x00H\\xffdf_\\x05!\\xffdc\\xfff4v\\x02\\x00\\x00\\x00\\xff80\\xffdc\\xfff4vL\\x08\\x0cwP\\xffd0\\xfff4v@\\x10\\xff8f\\x02\\xfff5\\xffe0\\xfff4v\\xffa0\\xffe7}w\"\\x00\\x00\\xffc0@\\x10\\xff8f\\x02\\x01\\x00\\x00\\x00\\xff8cF\\xffdb\\xffc4\\xffa8\\x00\\x00\\x00L\\x08\\x0cw\\xffe0\\xffd3\\xffbfj^\\x00\\x00\\x00F\\x02\\x00\\x00T\\x10\\xff8f\\x02\\x00\\x00\\x00\\x00x\\xff8b\\xff8e\\x021\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffe3_\\x050\\xffaf\\xff81w\\xffd8\\xff9f\\xff8e\\x02\\x08\\xffeb\\x0bwP\\xffd0\\xfff4v\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\x05\\x00\\x00\\x004\\x00\\x00\\x00\\x07}\\xffdbj\\x00\\x00\\x00\\x00\\x1d\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffcc\\xffe2_\\x05\\x00\\x00\\x00i\\xff80vXu\r\\x00\\x00\\x00 \\x00\\x00\\x00)\\x00\\x11\\x00 \\x00\\x00\\x00\\x1b\\x00\\x08\\x00\\x00\\xffdf_\\x05\\xfff4\r\\xff8f\\x02\\xffe8A\\xff92\\x02\\xffbfb~w\\x1f\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x02\\x00\n\\x00@\\x00\\x00\\x00\\xffd0\\x07>\\x02P\\x00\\x00\\x00\\xffd0\\x07>\\x02d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00\\xff88\\xff8a\\xff8e\\x02\\xffc0\\xff9d\\xff8e\\x02x\\xff8b\\xff8e\\x02x\\xff8b\\xff8e\\x02\\x00\\x00\\x00\\x00\\xffd8\\xff9f\\xff8e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00>\\x02\\xffe0\\x01>\\x02\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\xffa4\\x0c>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xffa0\\x0c>\\x02\\x1e^~w\\x1c\\xffdf_\\x05\\x1e^~wx\\xff8b\\xff8e\\x02\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd8\\xff9f\\xff8e\\x02x\\xff8b\\xff8e\\x02\\xff80\\xffdf_\\x05@\\x10\\xff8f\\x02\\xffd8\\xff9f\\xff8e\\x02P\\xffdf_\\x05\\xffa0r\\xfff4vX\\x10\\xff8f\\x02" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivationType" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Server" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemRoot%\\system32\\windows.storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\DllPath" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Threading" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\TrustLevel" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000003e8" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\CustomAttributes" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\RemoteServer" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateAsUser" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Permissions" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76f48688", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x74a60000" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f41074", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "ModuleHandle", "value": "0x74a60000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74b9c4a0" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f41086", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "ModuleHandle", "value": "0x74a60000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74c09490" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f410a3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "ModuleHandle", "value": "0x74a60000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74bfd580" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x74b33ffe", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d2470" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x74b33ee8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778141e0" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x74b33e67", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d0700" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x74b6707a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7780c3b0" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x74b33fa7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778053f0" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x774a9b67", "parentcaller": "0x74b34131", "category": "synchronization", "api": "NtCreateMutant", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "MutexName", "value": "Local\\SM0:5932:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 10:44:50,862", "thread_id": "10280", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774b9924", "parentcaller": "0x74b66be2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000003f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000003fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774b9924", "parentcaller": "0x74b66be2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000003f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000364" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b66a9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b66ab2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7780f53f", "parentcaller": "0x77731ae1", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7780f55e", "parentcaller": "0x77731ae1", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "packageContents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7780f97a", "parentcaller": "0x7780f68c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe0_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x06\\x008?\\x92\\x02X@\\x92\\x02h\\xef\\x8f\\x02\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7780f6c9", "parentcaller": "0x77731ae1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74bf0bef", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74bf0c33", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x08\\x02\\x93\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x74c0df6e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00020008" }, { "name": "TokenHandle", "value": "0x000003f8" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74c0df89", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\x9f\\x8c\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x74c0dfec", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74c0dfb5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74c0dfff", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0<\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x74b750ae", "parentcaller": "0x74b78f11", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xde_\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xdb_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xdc_\\x05\r\\x00\\x00\\x00\\xec-\\x81w\\x01\\x00\\x00\\x80\\xf9\\xa8\\xb9j\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x80\\x19\\x00\\x02\\x00\r\\x00\\x00\\x00\\x00`T\\x02" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x774ce3d7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76192bcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76192bb4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76192be3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8?\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2346 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74c03649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f109f", "parentcaller": "0x777ef039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "USERENV.dll" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f213c", "parentcaller": "0x777f2046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\userenv.dll" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777fe65c", "parentcaller": "0x777fe3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\userenv.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777fe699", "parentcaller": "0x777fe3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000003f8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\userenv.dll" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f122c", "parentcaller": "0x777f1397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75410000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00025000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f000f", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542f000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f00b7", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f00e5", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x77801ea8", "parentcaller": "0x77801e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x77801ea8", "parentcaller": "0x77801e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777d9d5b", "parentcaller": "0x777eb4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777fe6ed", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777fe6f5", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USERENV" }, { "name": "DllBase", "value": "0x75410000" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777edd72", "parentcaller": "0x777f1873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\userenv" }, { "name": "BaseAddress", "value": "0x75410000" }, { "name": "InitRoutine", "value": "0x754186d0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542f000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7542f000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2371 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02945000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2377 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Public" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2382 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Control\\Session Manager\\Environment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "u\\xff8c-\\xff82\\xfff1\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00,\\x00\\x00\\x00\\x16\\x01\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02946000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2423 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Default" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2428 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2433 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2438 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2443 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2448 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2453 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74189617", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\x03\\x93\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2459 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2461 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2466 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2470 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7418909e", "parentcaller": "0x74188b4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2477 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2481 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2488 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "DefaultUserEnviroment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\DefaultUserEnviroment" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "KeyInformation", "value": "\\xffde}\\xff86\\xffef\\xffb6\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x00\\x00\\x00f\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "KeyInformation", "value": "E\\xfffc\\xffb4r\\x05\\xffef\\xffdc\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\t\\x00\\x00\\x002\\x00\\x00\\x00>\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\0" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x7418954e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74199000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74199000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x75088afd", "parentcaller": "0x7508deb5", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7418751c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xc5_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x8c\\x02\\xc8\\xca_\\x05\\xd0\\xde_\\x050\\xaf\\x81w\"\\x80\\x9a\\xbf\\xfe\\xff\\xff\\xff\\xac\\xc5_\\x05d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xef\\x8f\\x02:\\x00\\x00\\x00" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b759ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8H\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x74b750ae", "parentcaller": "0x74b78f11", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xde_\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2547 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "{A520A1A4-1780-4FF6-BD18-167343C5AF16}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Category" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "LocalAppDataLow" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Name" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParentFolder" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Description" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "AppData\\LocalLow" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\RelativePath" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParsingName" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InfoTip" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalizedName" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Icon" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Security" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "S:(ML;OICI;NW;;;LW)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Security" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResource" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResourceType" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Roamable" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PreCreate" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Stream" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PublishExpandedPath" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\DefinitionFlags" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "8192" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Attributes" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\FolderTypeID" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InitFolderHandler" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PropertyBag" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xdb_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xdc_\\x05\r\\x00\\x00\\x00\\xec-\\x81w\\x01\\x00\\x00\\x80\\xf9\\xa8\\xb9j\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x80\\x19\\x00\\x02\\x00\r\\x00\\x00\\x00\\x00`T\\x02" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x774ce3d7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76192bcd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76192bb4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76192be3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0J\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2582 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74c03649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "{A520A1A4-1780-4FF6-BD18-167343C5AF16}" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2587 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2592 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Public" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2597 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Control\\Session Manager\\Environment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "KeyInformation", "value": "u\\xff8c-\\xff82\\xfff1\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00,\\x00\\x00\\x00\\x16\\x01\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2637 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Default" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2642 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2647 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2652 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2657 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2662 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2667 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74189617", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\x04\\x93\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2673 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2675 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2680 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2684 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7418909e", "parentcaller": "0x74188b4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2691 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2695 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2702 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "DefaultUserEnviroment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\DefaultUserEnviroment" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\xffde}\\xff86\\xffef\\xffb6\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x00\\x00\\x00f\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "E\\xfffc\\xffb4r\\x05\\xffef\\xffdc\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\t\\x00\\x00\\x002\\x00\\x00\\x00>\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\0" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x7418954e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x75088afd", "parentcaller": "0x7508deb5", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7418751c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xc5_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x8c\\x02\\xc8\\xca_\\x05\\xd0\\xde_\\x050\\xaf\\x81w\"\\x80\\x9a\\xbf\\xfe\\xff\\xff\\xff\\xac\\xc5_\\x05d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xef\\x8f\\x02(\\x00\\x00\\x00" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2755 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "{5E6C858F-0E22-4760-9AFE-EA3317B67173}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Profile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\DefinitionFlags" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PropertyBag" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0J\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2783 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b759ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x7780bc14", "parentcaller": "0x74d71e1a", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x76f9c8d0", "parentcaller": "0x76f4e379", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000003dc" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.StorageFileStaticsBrokered" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x76f9c980", "parentcaller": "0x76f9c92b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "KeyInformation", "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00F\\x00i\\x00l\\x00e\\x00S\\x00t\\x00a\\x00t\\x00i\\x00c\\x00s\\x00B\\x00r\\x00o\\x00k\\x00e\\x00r\\x00e\\x00d\\x00\\x00\\x00\\xff8c\\x02\\xff98\n>\\x02\\x02\\x00\\x00\\x00\\xffac\\xffdc_\\x05\\x1e^~w\\x01\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffae\\xff8e\\x02p\\xffae\\xff8e\\x02\\x02\\x00\\x00\\x00@\\xffde_\\x05!\\xffdc\\xfff4v\\x02\\x00\\x00\\x00\\xff80\\xffdc\\xfff4vL\\x08\\x0cwP\\xffd0\\xfff4v \\x17\\xff8f\\x02\\xfff5\\xffe0\\xfff4v\\x00\\xfff0\\x00\\x00\\x01\\x00\\x00\\x00 \\x17\\xff8f\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\x08\\x0cw\\xffae\\xffde_\\x05\\xffc2q~w\\xffab\\xff8c~w4\\x17\\xff8f\\x02\\x00\\x00\\xff8c\\x028\\xff90\\xff8e\\x020\\xffdf_\\x05\\x00\\x00\\x00\\x00 ?\\xff95t,)\\xfffftp\\xffae\\xff8e\\x02\\x08\\xffeb\\x0bwP\\xffd0\\xfff4v\\x13\\x00\\x00\\x13`@\\xff95tl\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xff9a\\xff8c\\x02\\x00\\x00\\x00\\x00H\\xff95\\xff8c\\x02\\xffa4\\xffe1_\\x05h\\xffde_\\x05H\\xff95\\xff8c\\x02\\xffa4\\xffe1_\\x05\\xffb0\\x0e\\xff8f\\x02 \\x00\\x00\\x00(\\x00\\x07\\x00 \\x00\\x00\\x00\\x1a\\x00\\x02\\x00\\xfff8\\xffdd_\\x05\\xfff4\r\\xff8f\\x02X@\\xff92\\x02\\xffbfb~wm\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x007\\x006\\x00@\\x00\\x00\\x00\\xffd0\\x07>\\x02P\\x00\\x00\\x00\\xffd0\\x07>\\x02d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00\\xff88\\xff8a\\xff8e\\x02\\xffc0\\xff9d\\xff8e\\x028\\xff90\\xff8e\\x028\\xff90\\xff8e\\x02\\x00\\x00\\x00\\x00p\\xffae\\xff8e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00>\\x02\\xffe0\\x01>\\x02\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\xffa4\\x0c>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xffa0\\x0c>\\x02\\x1e^~w\\x14\\xffde_\\x05\\x1e^~w8\\xff90\\xff8e\\x02\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffae\\xff8e\\x028\\xff90\\xff8e\\x02x\\xffde_\\x05 \\x17\\xff8f\\x02p\\xffae\\xff8e\\x02H\\xffde_\\x05\\xffa0r\\xfff4v8\\x17\\xff8f\\x02" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivationType" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Server" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemRoot%\\system32\\windows.storage.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\DllPath" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Threading" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\TrustLevel" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\CustomAttributes" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\RemoteServer" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateAsUser" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions" } ], "repeated": 1, "id": 2808 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eecbb", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76f48688", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 10:44:50,878", "thread_id": "10280", "caller": "0x774c952b", "parentcaller": "0x75f28561", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x75f1c6e0" }, { "name": "Parameter", "value": "0x03302b28" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10312" }, { "name": "ProcessId", "value": "5932" }, { "name": "Module", "value": "SHCORE.dll" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "CreateThread", "status": true, "return": "0x000002a4", "arguments": [ { "name": "StartRoutine", "value": "0x75f1c6e0" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "Parameter", "value": "0x03302b28" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774d0073", "parentcaller": "0x75f1c653", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002a4" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "10312" }, { "name": "ProcessId", "value": "5932" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x75f435da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsGetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774ac970" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774c952b", "parentcaller": "0x75f4e4f6", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x90T\\x02,\\x17\\x00\\x00H(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x75f29b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x778007b3", "parentcaller": "0x774b9057", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05880000" }, { "name": "RegionSize", "value": "0x00080000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x778007ed", "parentcaller": "0x774b9057", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05880000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774b9924", "parentcaller": "0x766ec2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000003f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02947000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774c952b", "parentcaller": "0x75f1d09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x90T\\x02,\\x17\\x00\\x00H(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000404" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f7c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000414" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000418" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd4\\x11\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00^\\xc4\\x0e;\\x00\t\\x00\\x80\\x00\\x12\\x8f\\x02\\x00\\x12\\x8f\\x02\\x00\\x12\\x8f\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb8d\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x04L\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "4D\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x000D\\x94\\x02\\x00\\x00#\\x00\\xbc\\xe4\\xb0\\xe4\\x18\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x18\\x04\\x00\\x00\\x04\\xe5\\x87\\x05\\xb3\\x91\\x7fw\\x18\\x04\\x00\\x00" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9jD@\\x03\\xc4\\xac\\xdf\\x87\\x05\\x18\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xbc\\xe4\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "T\\x0f\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\x00\\x00e\\x00s\\x00\\x00\\x00" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8_\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe4M\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "lH\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00hH\\x94\\x02\\x00\\x00#\\x00\\xa4\\xe2\\x98\\xe2\\x18\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x18\\x04\\x00\\x00\\xec\\xe2\\x87\\x05\\xb3\\x91\\x7fw\\x18\\x04\\x00\\x00" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j|F\\x03\\xc4\\x94\\xdd\\x87\\x05\\x18\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xa4\\xe2\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774adc35", "parentcaller": "0x774adfb3", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x774add50", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{00000035-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000418" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000414" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "T\\x0f\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\x00\\x00e\\x00s\\x00\\x00\\x00" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0a\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x03\\x00\\x00\\x00\\x84\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\N\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "tF\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00pF\\x94\\x02\\x00\\x00#\\x00\\xbc\\xe4\\xb0\\xe4\\x14\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x14\\x04\\x00\\x00\\x04\\xe5\\x87\\x05\\xb3\\x91\\x7fw\\x14\\x04\\x00\\x00" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9jD@\\x03\\xc4\\xac\\xdf\\x87\\x05\\x14\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xbc\\xe4\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "$\\x12\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00c\\x00a\\x00l\\x00L\\x00o\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "Ha\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "$M\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xacJ\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xa8J\\x94\\x02\\x00\\x00#\\x00\\xa4\\xe2\\x98\\xe2\\x14\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x14\\x04\\x00\\x00\\xec\\xe2\\x87\\x05\\xb3\\x91\\x7fw\\x14\\x04\\x00\\x00" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j|F\\x03\\xc4\\x94\\xdd\\x87\\x05\\x14\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xa4\\xe2\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2912 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\COM3" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "GipActivityBypass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76ef8a81", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000414" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x76f0fc40", "parentcaller": "0x76f0fbf0", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f0db05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f0f9ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x76f0fc40", "parentcaller": "0x76f0fbf0", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f0db05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000428" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f98793", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f0f9ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f31c58", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x6fcf0000" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x6fcf0000" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774b1b7a", "parentcaller": "0x76f41074", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x6fcf0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x70020ff0" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774b1b7a", "parentcaller": "0x76f41086", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x6fcf0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 10:44:50,893", "thread_id": "10312", "caller": "0x774b1b7a", "parentcaller": "0x76f410a3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x6fcf0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x70021060" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000418" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "4\\x16\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "Ha\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe4M\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb4H\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xb0H\\x94\\x02\\x00\\x00#\\x00\\xbc\\xe4\\xb0\\xe4\\x18\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x18\\x04\\x00\\x00\\x04\\xe5\\x87\\x05\\xb3\\x91\\x7fw\\x18\\x04\\x00\\x00" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9jD@\\x03\\xc4\\xac\\xdf\\x87\\x05\\x18\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xbc\\xe4\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "$\\x17\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x008\\x17\\x8f\\x02P\\x90\\x8e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x17\\x8f\\x02H\\x17\\x8f\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0a\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x03\\x00\\x00\\x00\\x84\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "$M\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "LG\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00HG\\x94\\x02\\x00\\x00#\\x00\\xa4\\xe2\\x98\\xe2\\x18\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\x18\\x04\\x00\\x00\\xec\\xe2\\x87\\x05\\xb3\\x91\\x7fw\\x18\\x04\\x00\\x00" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j|F\\x03\\xc4\\x94\\xdd\\x87\\x05\\x18\\x04\\x00\\x00h\\xef\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\xa4\\xe2\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x76f9c8d0", "parentcaller": "0x76f4e379", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000003dc" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Diagnostics.AsyncCausalityTracer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x76f9c980", "parentcaller": "0x76f9c92b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00f\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00D\\x00i\\x00a\\x00g\\x00n\\x00o\\x00s\\x00t\\x00i\\x00c\\x00s\\x00.\\x00A\\x00s\\x00y\\x00n\\x00c\\x00C\\x00a\\x00u\\x00s\\x00a\\x00l\\x00i\\x00t\\x00y\\x00T\\x00r\\x00a\\x00c\\x00e\\x00r\\x00~w\\x01\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff01\\xff94\\x02\\xfff01\\xff94\\x02\\x00\\x00\\x00\\x00\\x00\\xffd4_\\x05!\\xffdc\\xfff4v\\x02\\x00\\x00\\x00\\xff80\\xffdc\\xfff4vL\\x08\\x0cwP\\xffd0\\xfff4v \\x17\\xff8f\\x02\\xfff5\\xffe0\\xfff4vp\\xffd9_\\x05\\xffa0\\xffe7}w \\x17\\xff8f\\x02\\x01\\x00\\x00\\x00F\\x02\\x00\\x00Hs\\xffdb\\xffc4L\\x08\\x0cw\\x08\\x04\\x00\\x00\\xffe0\\xffd3\\xffbfj\\x00\\x00\\x00\\x004\\x17\\xff8f\\x02\\xfff5\\x02\\x00\\x00\\xfff8\\xff8e\\xff8e\\x02\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x08K\\xff94\\x02\\xffa8\\x00\\x00\\x00\\xfff01\\xff94\\x02\\x08\\xffeb\\x0bwP\\xffd0\\xfff4v\\x00\\x00\\xff8c\\x02\\x02\\x00\\x00\\x005\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x15\\x00\\x00\\x00A \\xffdbj[\\xffd5_\\x05<\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffa8O\\xff94\\x02\\xffedF\\x03p\\x00\\x00\\x00\\x00 \\x00\\x00\\x00&\\x00\\x03\\x00 \\x00\\x00\\x00\\x12\\x00\\x1e\\x00\\xffb8\\xffd3_\\x05\\xfff4\r\\xff8f\\x02`B\\xff92\\x02\\xffbfb~wl\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x002\\x00/\\x00@\\x00\\x00\\x00\\xffd0\\x07>\\x02P\\x00\\x00\\x00\\xffd0\\x07>\\x02d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00\\xff88\\xff8a\\xff8e\\x02\\xffc0\\xff9d\\xff8e\\x02\\xfff8\\xff8e\\xff8e\\x02\\xfff8\\xff8e\\xff8e\\x02\\x00\\x00\\x00\\x00\\xfff01\\xff94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00>\\x02\\xffe0\\x01>\\x02\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\xffa4\\x0c>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xffa0\\x0c>\\x02\\x1e^~w\\xffd4\\xffd3_\\x05\\x1e^~w\\xfff8\\xff8e\\xff8e\\x02\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff01\\xff94\\x02\\xfff8\\xff8e\\xff8e\\x028\\xffd4_\\x05 \\x17\\xff8f\\x02\\xfff01\\xff94\\x02\\x08\\xffd4_\\x05\\xffa0r\\xfff4v8\\x17\\xff8f\\x02" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000041c" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x76f48688", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\combase.dll" }, { "name": "BaseAddress", "value": "0x76e80000" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f41074", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76e80000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f87930" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f41086", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76e80000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76fb0310" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774b1b7a", "parentcaller": "0x76f410a3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76e80000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7002d000" }, { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7002d000" }, { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76efd257", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b66e4e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b66e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9278", "parentcaller": "0x76f86c28", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000042c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5932" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x74b669b7", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000e" }, { "name": "TokenHandle", "value": "0x00000430" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774b9924", "parentcaller": "0x74b66be2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000428" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000438" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74b66a9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74b66ab2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x74c30adb", "parentcaller": "0x777d105f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9278", "parentcaller": "0x74c30b0b", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5932" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x74c30b1e", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000414" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9e76", "parentcaller": "0x74c30b3a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74c30b43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74c30b4a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a9278", "parentcaller": "0x76f86c28", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5932" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043c" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000043c" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x94\\x10\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00c\\x00o\\x00m\\x00b\\x00a\\x00s\\x00e\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 10:44:50,909", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x88^\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xce\\xf8R^\\xed\\xacBZ\\x95\\xb4\\xf6t\\xdd\\x84\\x88^W\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xa9r\\x92\\xc1\\xf7$SG\\xa7i=!\\xb8VR\\x98" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "dO\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xdcG\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xd8G\\x94\\x02\\x00\\x00#\\x00D\\xe08\\xe0<\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0<\\x04\\x00\\x00\\x8c\\xe0\\x87\\x05\\xb3\\x91\\x7fw<\\x04\\x00\\x00" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xdc{\\x03\\xc44\\xdb\\x87\\x05<\\x04\\x00\\x00\\xe8\\xe9\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xffD\\xe0\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe4\\x10\\x8f\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8_\\x8f\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\x00\\x00" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "|O\\x94\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd4I\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xd0I\\x94\\x02\\x00\\x00#\\x00,\\xde \\xde<\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0<\\x04\\x00\\x00t\\xde\\x87\\x05\\xb3\\x91\\x7fw<\\x04\\x00\\x00" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j\\xdc\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xf4y\\x03\\xc4\\x1c\\xd9\\x87\\x05<\\x04\\x00\\x00\\xe8\\xe9\\x87\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff,\\xde\\x87\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774c952b", "parentcaller": "0x75f28561", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x90T\\x02,\\x17\\x00\\x00H(\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000440" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x75f1c6e0" }, { "name": "Parameter", "value": "0x03307b08" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10332" }, { "name": "ProcessId", "value": "5932" }, { "name": "Module", "value": "SHCORE.dll" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000440", "arguments": [ { "name": "StartRoutine", "value": "0x75f1c6e0" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "Parameter", "value": "0x03307b08" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774d0073", "parentcaller": "0x75f1c653", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000440" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "10332" }, { "name": "ProcessId", "value": "5932" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x75f435da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0294c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0294d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774c952b", "parentcaller": "0x75f4e4f6", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0T\\x02,\\x17\\x00\\x00\\(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x75f29b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10312", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bf0bef", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bf0c33", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x08\\x03\\x93\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x774abf45", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000042c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000430" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774abfb3", "parentcaller": "0x774abf5f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774abfef", "parentcaller": "0x774abf5f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\xd4\\x94\\x02 \\x00 \\x00|\\xd4\\x94\\x02\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\xd4\\x94\\x02T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00PS\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774abf6f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3096 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoPropertiesMyComputer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3100 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3102 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoPropertiesRecycleBin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3106 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a917f", "parentcaller": "0x75f145c6", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f4443f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d2470" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f16bb6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778141e0" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f1457a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d0700" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f43661", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7780c3b0" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f443ec", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778053f0" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x75f15eee", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x75f16c5d", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "MutexName", "value": "Local\\SM0:5932:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x75f29b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x75f29aae", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 1, "id": 3117 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x75f16f55", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000430" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x75f29b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x75f29aae", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 1, "id": 3120 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3121 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoControlPanel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f17bb5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3125 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3127 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoSetFolders" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f17bb5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3131 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3133 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoInternetIcon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3137 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3139 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\MicrosoftEdgeUpdate.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3141 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3145 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0294e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3152 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "NoCommonGroups" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3156 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777f3909", "parentcaller": "0x774cde38", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "x\\xec\\xa8\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x93\\x8c\\x02\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x17\\x00\\x80\\xbe\\x94\\x02\\xc0\\xc0\\x94\\x02\\xc0\\x93\\x8c\\x02\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\xcc\\xec\\xa8\\x05V<~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774cdeba", "parentcaller": "0x774cddb1", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774cde16", "parentcaller": "0x774cdd52", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\CLASSES" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f94e", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1581568" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b6f2be", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3175 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3177 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3179 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3181 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f171ea", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3185 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3189 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0294f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x74bcfd3e", "parentcaller": "0x74b5f45d", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02950000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3198 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000448" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(\\xf7\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3203 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000448" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\x0f\\x92\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3210 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3212 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Policies\\Microsoft\\Windows\\Explorer" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01\\xbf\\x9b_\\x16X\\xef\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x06\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74ba59bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f122c", "parentcaller": "0x777f1397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000420" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77270000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0003b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f000f", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x772a7000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74ba59bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\Windows\\SysWOW64" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f00b7", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x772a5000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f00e5", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x772a5000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x77801ea8", "parentcaller": "0x77801e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x77801ea8", "parentcaller": "0x77801e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": false, "return": "0xffffffffc000000f", "pretty_return": "NO_SUCH_FILE", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "FileInformation", "value": "" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\IntegratedServicesRegionPolicySet.json" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74be7069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x772a5000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-29 10:44:50,924", "thread_id": "10276", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x77270000" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\IntegratedServicesRegionPolicySet.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3234 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000008", "pretty_value": "KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Drive\\shellex\\FolderExtensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef8eb", "parentcaller": "0x7749e6db", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3237 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "DriveMask" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef8eb", "parentcaller": "0x7749e6db", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b5d6e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3243 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x7727c953", "parentcaller": "0x772819c5", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\CMApi" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x7727a4b8", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x7727a4b8", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cfgmgr32" }, { "name": "BaseAddress", "value": "0x77270000" }, { "name": "InitRoutine", "value": "0x7727cc10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x7727ceb5", "parentcaller": "0x7727ce14", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000420" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "$\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02951000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x7727ba76", "parentcaller": "0x7727b923", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000420" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "$\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000448" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000041c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3253 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000440" }, { "name": "ValueName", "value": "DontShowSuperHidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3257 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10340", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02952000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000290" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000440" }, { "name": "ValueName", "value": "ShellState" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 1, "id": 3261 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74be99d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000041c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000448" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3265 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "NoWebView" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3270 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ClassicShell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3275 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10340", "caller": "0x74c0470b", "parentcaller": "0x77809680", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000EDDC00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3278 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "SeparateProcess" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f180c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3283 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3285 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8\\x07\\x92\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x74b34131", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000450" }, { "name": "MutexName", "value": "Local\\SM0:5932:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x74b3430b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\xff\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b543f5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000450" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x74b544c4", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x74b54504", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b54457", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Directory" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x774b18aa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10276", "caller": "0x774a9310", "parentcaller": "0x774b1846", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Folder" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3328 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "AllFilesystemObjects" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StructuredQuery" }, { "name": "DllBase", "value": "0x754f0000" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\StructuredQuery.dll" }, { "name": "BaseAddress", "value": "0x754f0000" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x74b67198", "parentcaller": "0x74bfaa30", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "934D4698-6A59-48F8-9F29-9FB30670320E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "71D222E1-432F-429E-8C13-B6DAFDE5077A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 3358 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75568000" }, { "name": "ModuleName", "value": "StructuredQuery.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75568000" }, { "name": "ModuleName", "value": "StructuredQuery.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7551420d", "parentcaller": "0x755224b9", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090c09", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000c09" }, { "name": "LanguageName", "value": "English (Australia)" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b75067", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xda\\xa8\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3365 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000290" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xac\\xd8\\xa8\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x10\\xb0\\x1bv\\x84\\xf0\\xcc\\xed,\\xd9\\xa8\\x05H\\xf5\\xb2t\\x01\\x00\\x00\\x00\\xf8\\xd8\\xa8\\x05\\x00\\x00\\x00\\x00\\xa0\\xf5\\xb2t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\xf5\\xb2t\\xdc\\x8a\\xabtP\\xd9\\xa8\\x05L\\xd9\\xa8\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x777cd7d7", "parentcaller": "0x774ce3d7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74c03649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-29 10:44:50,940", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Start Menu" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b758f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b759ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b75067", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000454" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xda\\xa8\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3403 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Common Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName" } ], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000041c" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000290" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3431 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Common Start Menu" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%ProgramData%\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b758f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b75c55", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b75067", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xda\\xa8\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3439 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@shell32,dll,-12692" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\shell32.dll,-21797" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName" } ], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Icon" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemRoot%\\system32\\imageres.dll,-117" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable" } ], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000290" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xac\\xd8\\xa8\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x10\\xb0\\x1bv\\x84\\xf0\\xcc\\xed,\\xd9\\xa8\\x05H\\xf5\\xb2t\\x01\\x00\\x00\\x00\\xf8\\xd8\\xa8\\x05\\x00\\x00\\x00\\x00\\xa0\\xf5\\xb2t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\xf5\\xb2t\\xdc\\x8a\\xabtP\\xd9\\xa8\\x05L\\xd9\\xa8\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777cd7d7", "parentcaller": "0x774ce3d7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74c03649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "Recent" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b758f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b759ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b75067", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000454" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xda\\xa8\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3477 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000041c" }, { "name": "ObjectAttributesName", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Windows" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b758f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b75067", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000454" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xda\\xa8\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3508 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b722a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Category" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "System" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName" } ], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security" } ], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate" } ], "repeated": 0, "id": 3526 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "PropertyBag" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b72acf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b758f3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x74b7b89b", "parentcaller": "0x74b7b160", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x766ec2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000045c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f109f", "parentcaller": "0x777ef039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "PROPSYS.dll" } ], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f213c", "parentcaller": "0x777f2046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777fe65c", "parentcaller": "0x777fe3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777fe699", "parentcaller": "0x777fe3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000460" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f122c", "parentcaller": "0x777f1397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000464" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70910000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000c2000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f000f", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3545 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f00b7", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c1000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f00e5", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c1000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x77801ea8", "parentcaller": "0x77801e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x77801ea8", "parentcaller": "0x77801e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777d9d5b", "parentcaller": "0x777eb4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c1000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777fe6ed", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777fe6f5", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c1000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\PROPSYS" }, { "name": "DllBase", "value": "0x70910000" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\propsys" }, { "name": "BaseAddress", "value": "0x70910000" }, { "name": "InitRoutine", "value": "0x70970b90" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02955000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x74b3305d", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b4b27e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x74b3430b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 1, "id": 3566 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a917f", "parentcaller": "0x70953c4a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x70953c1b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d2470" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x7095391b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778141e0" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x7095389a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d0700" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x7095206a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7780c3b0" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x709539da", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778053f0" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x70952dde", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x7093564c", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "MutexName", "value": "Local\\SM0:5932:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x709376b6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x709355e8", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 1, "id": 3576 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774a9b67", "parentcaller": "0x709354c7", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x709376b6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774add70", "parentcaller": "0x709355e8", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 1, "id": 3579 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774c952b", "parentcaller": "0x75f28561", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0T\\x02,\\x17\\x00\\x00\\(\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000474" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x75f1c6e0" }, { "name": "Parameter", "value": "0x033087a0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10356" }, { "name": "ProcessId", "value": "5932" }, { "name": "Module", "value": "SHCORE.dll" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000474", "arguments": [ { "name": "StartRoutine", "value": "0x75f1c6e0" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "Parameter", "value": "0x033087a0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "10356" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774d0073", "parentcaller": "0x75f1c653", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000474" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "10356" }, { "name": "ProcessId", "value": "5932" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x75f435da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774c952b", "parentcaller": "0x75f4e4f6", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 U\\x02,\\x17\\x00\\x00t(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10356" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x75f29b0e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x76f9c8d0", "parentcaller": "0x76f4e379", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000003dc" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.FileTypeAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x76f9c980", "parentcaller": "0x76f9c92b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x01\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x007\\xff94\\x02\\x007\\xff94\\x02\\x00\\x00\\x00\\x008\\xffef\\xffd0\\x05!\\xffdc\\xfff4v\\x02\\x00\\x00\\x00\\xff80\\xffdc\\xfff4vL\\x08\\x0cwP\\xffd0\\xfff4v\\xffa0\\x14\\xff8f\\x02\\xfff5\\xffe0\\xfff4v\\xffc8\\x18\\x13{\\xff96\\xffef\\xffd0\\x05\\xffa0\\x14\\xff8f\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\x08\\x0cw\\x00\\x00\\x00\\x00\\xffc8\\x18\\x13{\\xffae\\xffef\\xffd0\\x05\\xffb4\\x14\\xff8f\\x02\\x00\\x00\\x00\\x00x\\xff8e\\xff8e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x007\\xff94\\x02\\x08\\xffeb\\x0bwP\\xffd0\\xfff4v\\xffd8\\xffd3\\xff8f\\x02\\xff8c\\xfff2\\xffd0\\x05W\\xfff5~w_\\xfff5~wl\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xff9a\\xff8c\\x02\\x00\\x00\\x00\\x00\\xffd8\\xffd3\\xff8f\\x02\\xffa4\\xfff2\\xffd0\\x05h\\xffef\\xffd0\\x05\\xffd8\\xffd3\\xff8f\\x02 \\x00\\x00\\x00!\\x00\\x0c\\x00 \\x00\\x00\\x00\\x08\\x00\\x12\\x00\\xfff0\\xffee\\xffd0\\x05\\xfff4\r\\xff8f\\x02\\x10D\\xff95\\x02\\xffbfb~w&\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x1f\\x00\\x17\\x00@\\x00\\x00\\x00\\xffd0\\x07>\\x02P\\x00\\x00\\x00\\xffd0\\x07>\\x02d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00\\xff88\\xff8a\\xff8e\\x02\\xffc0\\xff9d\\xff8e\\x02x\\xff8e\\xff8e\\x02x\\xff8e\\xff8e\\x02\\x00\\x00\\x00\\x00\\x007\\xff94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00>\\x02\\xffe0\\x01>\\x02\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\xffa4\\x0c>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xffa0\\x0c>\\x02\\x1e^~w\\x0c\\xffef\\xffd0\\x05\\x1e^~wx\\xff8e\\xff8e\\x02\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x007\\xff94\\x02x\\xff8e\\xff8e\\x02p\\xffef\\xffd0\\x05\\xffa0\\x14\\xff8f\\x02\\x007\\xff94\\x02@\\xffef\\xffd0\\x05\\xffa0r\\xfff4v\\xffb8\\x14\\xff8f\\x02" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000464" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x76fa60da", "parentcaller": "0x76f4e339", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000003c4" }, { "name": "ObjectAttributesName", "value": "Server" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x76f9c8d0", "parentcaller": "0x76f4e379", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000468" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x76f9c980", "parentcaller": "0x76f9c92b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\xff93\\x028<\\xff95\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00>\\x02\\xffcc\\x01>\\x02\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xff9c\n>\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x02\\xff98\n>\\x02\\x00\\x00\\xffd1\\x05\\xff84\\xffea\\xffd0\\x05\\x1e^~w\\x01\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000;\\xff94\\x020;\\xff94\\x02XB\\xff95\\x020;\\xff94\\x02\\xff8dE\\x03w\\x1c\\xffec\\xffd0\\x05\\xff80\\xffdc\\xfff4vH\\xffb9\\xff94\\x02P\\xffd0\\xfff4v\\xfff0\\x14\\xff8f\\x02\\xfff5\\xffe0\\xfff4v\\x08\\xffeb\\xffd0\\x05\\xff9fn\\xffbdj\\xfff0\\x14\\xff8f\\x02\\x01\\x00\\x00\\x00\\xffc4o\\xffdbj\\x00\\xffeb\\xffd0\\x05d\\xffff\\xffbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(OT\\xffc4\\xffda`\\xfffav\\x00\\x00\\x00\\x009\\xffe3\\xfff4v8\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00\\xffd1\\x05\\x00\\x00\\x00\\x00\\xffc8\\xffea\\xffd0\\x05\\x1f\\xffdd\\xffbbj\\xffc4\\xfff8\\xffd0\\x05\\xffda`\\xfffav8|\\xffddj9\\xffe3\\xfff4v@\\xffeb\\xffd0\\x05\\xff96\\xffe3\\xffbbj\\xffc0\\xffe2\\xffdaj\\x00OT\\xffc4h\\xffe6\\xffd0\\x058|\\xffddj\\xffc4\\xfff8\\xffd0\\x05\\xffa0\\xffe6\\xffd0j\\x00\\x05X\\xffab\\xfffe\\xffff\\xffff\\xffff\\xff8c\\xffeb\\xffd0\\x05\\xffffh\\xffbdjE\\x00\\x00\\x00\\xffd0h\\xffdbj\\xffc8n\\xffdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc1n\\xffdbj\\xffe4m\\xffdbjP\\xffb9\\xff94\\x02P%\\xffdbj\\x19\\x01\\x02\\x00\\xff8cn\\xffdbj\\xffc4\\x03\\x00\\x00tn\\xffdbj\\xffe0\\xffeb\\xffd0\\x05\\xffce\\xffae\\x15\\xffbf\\xffc8\\xffb7\\xff94\\x02\\xffc4\\x03\\x00\\x00P\\xffb9\\xff94\\x02P\\xffb9\\x00\\x00h\\xffeb\\xffd0\\x05\\xffc8\\xffb7\\xff94\\x02\\xffc4\\xfff8\\xffd0\\x050\\xffaf\\xff81w\\xffd2\\xff83O\\xffcd\\xfffe\\xffff\\xffff\\xffff\\xffc4\\xffeb\\xffd0\\x05\\xffe1`\\xfffav\\x00\\x00\\x00\\x00\\xffc4\\x03\\x00\\x00\\x00\\x00>\\x02\\x18\\x00\\x00\\x00\\xffc4\\x03\\x00\\x00\\xffe0\\xffeb\\xffd0\\x05@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x0c>\\x02\\xfff8\\xffeb\\xffd0\\x059\\xffe3\\xfff4v\\x19\\x01\\x02\\x00P\\xffb9\\xff94\\x02`8\\xfffavH\\xffb9\\xff94\\x02`B\\xff95\\x02\\xfff4\\xffeb\\xffd0\\x05\\x0f\\xfff0\\xfffbv\\xffec\\x07\\x0cw\\x0c\\xffec\\xffd0\\x05H\\xffb9\\xff94\\x02\\x10\\xffec\\xffd0\\x05\\xffad8\\xfffavh\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 3615 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eecbb", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000470" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f48688", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f48688", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774b9924", "parentcaller": "0x766ec2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000470" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02956000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02957000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x766eeacc", "parentcaller": "0x766eea60", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-29 10:44:50,956", "thread_id": "10356", "caller": "0x774b9924", "parentcaller": "0x76f6ee83", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000047c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x76f61477", "parentcaller": "0x76f68b43", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x76f0fc40", "parentcaller": "0x76f0fbf0", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f0db05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f0f9ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x76f0fc40", "parentcaller": "0x76f0fbf0", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f0db05", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000360" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000484" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f98793", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f0f9ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f31c58", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x6aaf0000" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x6aaf0000" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774b1b7a", "parentcaller": "0x76f41074", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x6aaf0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6ab6c840" } ], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774b1b7a", "parentcaller": "0x76f41086", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x6aaf0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x774b1b7a", "parentcaller": "0x76f410a3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x6aaf0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6ab6c820" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02958000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x777f621a", "parentcaller": "0x774cd839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x777f6241", "parentcaller": "0x774cd839", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x766eeacc", "parentcaller": "0x766eea60", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-29 10:44:50,971", "thread_id": "10356", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000488" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f2fea5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774a040b", "parentcaller": "0x76f2feb1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10356", "caller": "0x774c952b", "parentcaller": "0x75f1d09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00 U\\x02,\\x17\\x00\\x00t(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10356" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers" } ], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "ValueName", "value": ".json" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers\\.json" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3696 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.json" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b543f5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000048c" } ], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x74b544c4", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x74b54504", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b54457", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3702 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3705 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3707 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3712 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x774b39fb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x774b3a0c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778062c0" } ], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3716 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3718 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd1798", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000048c" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd1706", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\x07\\x92\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3721 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd1727", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 3722 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3726 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3729 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000418" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3732 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3733 }, { "timestamp": "2026-05-29 10:44:50,987", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3734 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Unknown" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000490" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\CurVer" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000490" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b54950", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 3738 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000494" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 3739 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000048c" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3741 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.json" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3743 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3745 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "ValueName", "value": "PerceivedType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 3748 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3749 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.json" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b543f5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000490" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x74b544c4", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x74b54504", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3753 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b54457", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3755 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3758 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3760 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3765 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3767 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd1798", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000498" } ], "repeated": 0, "id": 3769 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd1706", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\x17\\x92\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd1727", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3774 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3775 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3778 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "*" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*" } ], "repeated": 0, "id": 3779 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000490" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3781 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "AllFilesystemObjects" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000414" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 3785 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3789 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 3790 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "KeyInformation", "value": "\\xffd0\\x14\\xffde$\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b581bf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x70910000" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7094ce2b", "parentcaller": "0x7095e346", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03309000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3799 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3800 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows Search" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "SystemIndexNormalization" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\SystemIndexNormalization" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0295a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aba8f", "parentcaller": "0x774ab72c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\system32\\" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abb06", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abb4e", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abbca", "parentcaller": "0x774ab72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab788", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\system32\\" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab788", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "HandleName", "value": "C:\\Windows\\SysWOW64" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab788", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3816 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aba8f", "parentcaller": "0x774ab72c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abb06", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3820 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abb4e", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3821 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774abbca", "parentcaller": "0x774ab72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3822 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab788", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab788", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab788", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3826 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab846", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 3829 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab846", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "HandleName", "value": "\\Device\\HarddiskVolume2" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab846", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab33a", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab33a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000049c" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutputBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774ab34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3837 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000049c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3839 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x74c0470b", "parentcaller": "0x77809680", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3841 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd102d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a0" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\xff\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000049c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x7748e3f2", "parentcaller": "0x74c046c9", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x7748e455", "parentcaller": "0x74c046c9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x774cd3de", "parentcaller": "0x7748e474", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a4" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x7748e4aa", "parentcaller": "0x74c046c9", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0xb34c3674" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10276", "caller": "0x7748e4b5", "parentcaller": "0x74c046c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6082d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3854 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" } ], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": ".json" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.json" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7093820f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3858 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "application/json" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type" } ], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x70938252", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74b543f5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000049c" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x74b544c4", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x74b54504", "parentcaller": "0x74b54418", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b54457", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3866 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3867 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3869 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3870 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3871 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3876 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3878 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd1798", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a0" } ], "repeated": 0, "id": 3880 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd1706", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\x0f\\x92\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd1727", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7780bc14", "parentcaller": "0x74b32b07", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c05407", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74c0544b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xfd\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3886 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3889 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049c" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3892 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3894 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "Unknown" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004a8" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\CurVer" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004a8" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b54950", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3900 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.json" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3902 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json" } ], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "ValueName", "value": "PerceivedType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 3905 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3906 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.json" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.json" } ], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\DocObject" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049c" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\DocObject" } ], "repeated": 0, "id": 3909 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\DocObject" } ], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\DocObject" } ], "repeated": 0, "id": 3911 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\BrowseInPlace" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049c" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\BrowseInPlace" } ], "repeated": 0, "id": 3913 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\BrowseInPlace" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\BrowseInPlace" } ], "repeated": 0, "id": 3915 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "application/json" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type" } ], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049c" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Clsid" } ], "repeated": 0, "id": 3917 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\Clsid" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\IsShortcut" } ], "repeated": 0, "id": 3919 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\IsShortcut" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\AlwaysShowExt" } ], "repeated": 0, "id": 3921 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\AlwaysShowExt" } ], "repeated": 0, "id": 3922 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\NeverShowExt" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\NeverShowExt" } ], "repeated": 0, "id": 3924 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x70959f7b", "parentcaller": "0x7094658d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e2ff", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b762b", "parentcaller": "0x7094de75", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028b0000" }, { "name": "SectionOffset", "value": "0x05a8e37c" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b762b", "parentcaller": "0x70942e49", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05d10000" }, { "name": "SectionOffset", "value": "0x05a8f224" }, { "name": "ViewSize", "value": "0x00049000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab021", "parentcaller": "0x774ada15", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac899", "parentcaller": "0x774ada1f", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab021", "parentcaller": "0x774ada2b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774cab2e", "parentcaller": "0x709525d9", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 0, "id": 3940 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774cab2e", "parentcaller": "0x709525d9", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\propsys.dll" } ], "repeated": 0, "id": 3941 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3942 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e2ff", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3943 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3944 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b762b", "parentcaller": "0x7094de75", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000414" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032f0000" }, { "name": "SectionOffset", "value": "0x05a8e2d4" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3945 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3946 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774b762b", "parentcaller": "0x70942e49", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000490" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05d60000" }, { "name": "SectionOffset", "value": "0x05a8f17c" }, { "name": "ViewSize", "value": "0x0009c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3947 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab021", "parentcaller": "0x774ada15", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3948 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ac899", "parentcaller": "0x774ada1f", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 0, "id": 3949 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774ab021", "parentcaller": "0x774ada2b", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 3950 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774cab2e", "parentcaller": "0x709525d9", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 0, "id": 3951 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774cab2e", "parentcaller": "0x709525d9", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\propsys.dll" } ], "repeated": 0, "id": 3952 }, { "timestamp": "2026-05-29 10:44:51,003", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Windows.Storage.Search" }, { "name": "DllBase", "value": "0x6aa50000" } ], "repeated": 0, "id": 3953 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.Search.dll" }, { "name": "BaseAddress", "value": "0x6aa50000" } ], "repeated": 0, "id": 3954 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x74c384bc", "parentcaller": "0x74c38d25", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "18907F3B-9AFB-4F87-B764-F9A4E16A21B8" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "522E34A4-07F7-40A1-94D0-1BFE832EFC3A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3955 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aadd000" }, { "name": "ModuleName", "value": "Windows.Storage.Search.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3956 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aadd000" }, { "name": "ModuleName", "value": "Windows.Storage.Search.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3957 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x74c384bc", "parentcaller": "0x74c38810", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "18907F3B-9AFB-4F87-B764-F9A4E16A21B8" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "522E34A4-07F7-40A1-94D0-1BFE832EFC3A" }, { "name": "ProgID", "value": "" } ], "repeated": 6, "id": 3958 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x76f38cc3", "parentcaller": "0x76f38b45", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3959 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777f1f80", "parentcaller": "0x777d8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 3960 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\windows.storage.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3961 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004bc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\windows.storage.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3962 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777d97cc", "parentcaller": "0x777d92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004c0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004bc" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\windows.storage.dll.mui" } ], "repeated": 0, "id": 3963 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777d97f4", "parentcaller": "0x777d92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03390000" }, { "name": "SectionOffset", "value": "0x05a8e3c8" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3964 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777d9804", "parentcaller": "0x777d92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 3965 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x76f18ca5", "parentcaller": "0x76fb2c0e", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3966 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3967 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3968 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x764109b0", "parentcaller": "0x76410ab4", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001f8" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00 \\xe1\\xa8\\x050\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3969 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aa206", "parentcaller": "0x76411181", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x75df0000" } ], "repeated": 0, "id": 3970 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774b1b7a", "parentcaller": "0x764112a6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "ModuleHandle", "value": "0x75df0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e05880" } ], "repeated": 0, "id": 3971 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3972 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3973 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x76f16631", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00@\\x17\\x92\\x026\\x007\\x00c\\x003\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x02\\x01\\x00\\x00\\x00\\x00\\x00>\\x02\\xe8\\x11>\\x02\\xf9\\xff\\xff\\xff8\\x001\\x00c\\x00d\\x002\\x00c\\x003\\x005\\x00^e\\xf1v\\xec\\xe4\\xa8\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3974 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x74be8c8c", "parentcaller": "0x74be8a85", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3975 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66e4e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 3976 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 3977 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66ea6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 3978 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7559ddd8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 3979 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x755cf000" }, { "name": "ModuleName", "value": "SystemSettings.DataModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3980 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x755cf000" }, { "name": "ModuleName", "value": "SystemSettings.DataModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3981 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 3982 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10332", "caller": "0x774c952b", "parentcaller": "0x75f1d09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0T\\x02,\\x17\\x00\\x00\\(\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 3983 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3984 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 3985 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3986 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 3987 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f2c4d2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "9" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3988 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c517", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 3989 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 3990 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74bc7f26", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 3991 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 3992 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x755a67ef", "parentcaller": "0x755a80ee", "category": "synchronization", "api": "NtCreateMutant", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3993 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x755a882d", "parentcaller": "0x755a9bd4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3994 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x755cf000" }, { "name": "ModuleName", "value": "SystemSettings.DataModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3995 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x755cf000" }, { "name": "ModuleName", "value": "SystemSettings.DataModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3996 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x76f18ca5", "parentcaller": "0x76fb674b", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3997 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x76f16631", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x000\\x00e\\x003\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x96\\x02\\x03r\\xf1v8\\xdd_\\x0563\\xf9v\\x00\\x00\\x8c\\x02a\\x005\\x00a\\x008\\x00e\\x007\\x00d\\x000\\x00^e\\xf1v\\x8c\\xdd_\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3998 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x755a67ef", "parentcaller": "0x755a80ee", "category": "synchronization", "api": "NtCreateMutant", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3999 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x755a882d", "parentcaller": "0x755a9bd4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4000 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 4001 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\x00\\xee\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4002 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xee\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4003 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\x00\\xee\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4004 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xee\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4005 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x001\\x008\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x008\\x000\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 4006 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00I\\x00s\\x00E\\x00d\\x00g\\x00e\\x00U\\x00n\\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00a\\x00b\\x00l\\x00e\\x00P\\x00e\\x00r\\x00R\\x00e\\x00g\\x00i\\x00o\\x00n\\x00a\\x00l\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x000\\x00]\\x00" }, { "name": "Length", "value": "82" } ], "repeated": 0, "id": 4007 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 4008 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 4009 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4010 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76e80000" }, { "name": "FunctionName", "value": "RoUninitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76fb4aa0" } ], "repeated": 0, "id": 4011 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4012 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 4013 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\xe0\\xee\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4014 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe0\\xee\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4015 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\xe0\\xee\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4016 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe0\\xee\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4017 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x001\\x008\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x008\\x000\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 4018 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00E\\x00d\\x00g\\x00e\\x00 \\x00n\\x00o\\x00t\\x00 \\x00u\\x00n\\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00a\\x00b\\x00l\\x00e\\x00 \\x00p\\x00e\\x00r\\x00 \\x00r\\x00e\\x00g\\x00i\\x00o\\x00n\\x00a\\x00l\\x00 \\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00,\\x00 \\x00s\\x00k\\x00i\\x00p\\x00p\\x00i\\x00n\\x00g\\x00 \\x00g\\x00r\\x00o\\x00u\\x00p\\x00 \\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00" }, { "name": "Length", "value": "134" } ], "repeated": 0, "id": 4019 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 4020 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 4021 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xe3_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00XC\\xddj\\xac\\xe3_\\x05L\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00`\\x05\\x9c\\xe6_\\x05\\x1c\\xe3_\\x05`\\xe3_\\x05\\x94\\xe5_\\x05\\xa0\\xe6\\xd0j\\x10;X\\xab" } ], "repeated": 0, "id": 4022 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4023 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004b8" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4024 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 4025 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4026 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 1, "id": 4027 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4028 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RevertToSelf" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6fa10" } ], "repeated": 0, "id": 4029 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4030 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4031 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75810000" }, { "name": "FunctionName", "value": "CharUpperBuffW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7589bb00" } ], "repeated": 0, "id": 4032 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4033 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774bd1fa", "parentcaller": "0x774a9744", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" }, { "name": "EventName", "value": "Global\\EdgeUpdateUpdaterRunning{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "EventType", "value": "0" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 4034 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 4035 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 4036 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xe1_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x80\\x00\\x00\\x00I\\x01\\x00\\x00\\x04\\x03:\\x03\\x01\\x00\\x00\\x00\\xd8\\xe9x\\x03L\\x00\\x00\\x00&\\x00\\x00\\x00\\x03+\\xffj&x\\x90\\x02h\\xbe\\x93\\x02L\\x00\\x00\\x00" } ], "repeated": 0, "id": 4037 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4038 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000428" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4039 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 4040 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4041 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4042 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000408" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4043 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted" } ], "repeated": 0, "id": 4044 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4045 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000408" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4046 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv" } ], "repeated": 0, "id": 4047 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv" } ], "repeated": 0, "id": 4048 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang" } ], "repeated": 0, "id": 4049 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name" } ], "repeated": 0, "id": 4050 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Edge" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name" } ], "repeated": 0, "id": 4051 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4052 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000428" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4053 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4054 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4055 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4056 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4057 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4058 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4059 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4060 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4061 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4062 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4063 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4064 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4065 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 1, "id": 4066 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "dr" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 0, "id": 4067 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af1d609", "parentcaller": "0x6af1d2b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4068 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4069 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4070 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4071 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4072 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4073 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4074 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4075 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4076 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 0, "id": 4077 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af1d6e3", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4078 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af1d3f2", "parentcaller": "0x6af05849", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 4079 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000428" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4080 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang" } ], "repeated": 0, "id": 4081 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4082 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb369", "parentcaller": "0x6af051b2", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "4" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4083 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4084 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegEnumValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6edd0" } ], "repeated": 0, "id": 4085 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4086 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb3c1", "parentcaller": "0x6af051eb", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 4087 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb3c1", "parentcaller": "0x6af051eb", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "urlstats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\urlstats" } ], "repeated": 0, "id": 4088 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb3c1", "parentcaller": "0x6af051eb", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "freseenversion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion" } ], "repeated": 0, "id": 4089 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb3c1", "parentcaller": "0x6af051eb", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "freseen" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen" } ], "repeated": 0, "id": 4090 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af0535d", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "2" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4091 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0538e", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "FirstNotDefault" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\FirstNotDefault" } ], "repeated": 0, "id": 4092 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0538e", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "LastWasDefault" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LastWasDefault" } ], "repeated": 0, "id": 4093 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af05163", "parentcaller": "0x6af058f0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4094 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap" } ], "repeated": 0, "id": 4095 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken" } ], "repeated": 0, "id": 4096 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" } ], "repeated": 0, "id": 4097 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)" } ], "repeated": 0, "id": 4098 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "rrf@0.99" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)" } ], "repeated": 0, "id": 4099 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "hint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint" } ], "repeated": 0, "id": 4100 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint" } ], "repeated": 0, "id": 4101 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 4102 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 4103 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aee6e8b", "parentcaller": "0x6af05935", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4104 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "iid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\iid" } ], "repeated": 0, "id": 4105 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "brand" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand" } ], "repeated": 0, "id": 4106 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "brand" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "INBX" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand" } ], "repeated": 0, "id": 4107 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "client" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\client" } ], "repeated": 0, "id": 4108 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ActivePingDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779926400" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec" } ], "repeated": 0, "id": 4109 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6af046da", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4110 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779926400" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec" } ], "repeated": 0, "id": 4111 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6af046da", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4112 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4113 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4114 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4115 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4116 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4117 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4118 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4119 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "InstallTime" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779981955" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallTime" } ], "repeated": 0, "id": 4120 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aee5eb5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4121 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aee5f69", "parentcaller": "0x6af06f95", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4122 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "DayOfLastActivity" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity" } ], "repeated": 0, "id": 4123 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall" } ], "repeated": 0, "id": 4124 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4125 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4126 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4127 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4128 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4129 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4130 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4131 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfInstall" } ], "repeated": 0, "id": 4132 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aee613e", "parentcaller": "0x6af06ff8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4133 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4134 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4135 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4136 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4137 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4138 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4139 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4140 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "oobeinstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall" } ], "repeated": 0, "id": 4141 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "oobeinstall" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "13424455577847925" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall" } ], "repeated": 0, "id": 4142 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aee622b", "parentcaller": "0x6af0706f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4143 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4144 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4145 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4146 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4147 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4148 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4149 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4150 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "updatecount" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatecount" } ], "repeated": 0, "id": 4151 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aee62d4", "parentcaller": "0x6af070e3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4152 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aebcc05", "parentcaller": "0x6af67f55", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00000026", "pretty_value": "CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 4153 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6aebcc05", "parentcaller": "0x6af67fc2", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x0000001a", "pretty_value": "CSIDL_APPDATA" }, { "name": "Path", "value": "C:\\Users\\admin\\AppData\\Roaming" } ], "repeated": 0, "id": 4154 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774cab2e", "parentcaller": "0x6aec0920", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" } ], "repeated": 0, "id": 4155 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774ac9d6", "parentcaller": "0x6aec64c7", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x028e8e38", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*" }, { "name": "FirstCreateTimeLow", "value": "0xd86f70bb" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceeb6" } ], "repeated": 0, "id": 4156 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774c8cb8", "parentcaller": "0x6aec653a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4157 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x74a60000" } ], "repeated": 0, "id": 4158 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x6af67cbf", "parentcaller": "0x6af67e76", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 4159 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a9b67", "parentcaller": "0x774a92be", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4160 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4161 }, { "timestamp": "2026-05-29 10:44:51,018", "thread_id": "10280", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0330a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4162 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e051", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4163 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aa90c", "parentcaller": "0x75f1e191", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" }, { "name": "Buffer", "value": "[LocalizedFileNames]\r\nFile Explorer.lnk=@%SystemRoot%\\system32\\shell32.dll,-22067\r\n" }, { "name": "Length", "value": "83" } ], "repeated": 0, "id": 4164 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e118", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 1, "id": 4165 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x75f2334a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4166 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f23366", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 1, "id": 4167 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77596000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4168 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77596000" }, { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4169 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4170 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74b9ce93", "parentcaller": "0x74f55c61", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4171 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094e548", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 1, "id": 4172 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Windows*system32*config*systemprofile*AppData*Local*Microsoft*Windows*Caches*cversions.1" } ], "repeated": 0, "id": 4173 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Windows*system32*config*systemprofile*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro" } ], "repeated": 0, "id": 4174 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094e548", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 4175 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x70950337", "parentcaller": "0x7094e3dc", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" } ], "repeated": 0, "id": 4176 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4177 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4178 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x7094feba", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000438" } ], "repeated": 0, "id": 4179 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x7094fed8", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4180 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x7094ff1a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xfe\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 4181 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094ff3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4182 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cefe0", "parentcaller": "0x70950249", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4183 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cf02d", "parentcaller": "0x70950249", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4184 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cefe0", "parentcaller": "0x7095027e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4185 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cf02d", "parentcaller": "0x7095027e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4186 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x7095029c", "category": "process", "api": "NtOpenProcessToken", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x000f01ff" }, { "name": "TokenHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4187 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4188 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094e548", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 4189 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Windows*system32*config*systemprofile*AppData*Local*Microsoft*Windows*Caches*cversions.1" } ], "repeated": 0, "id": 4190 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac34d", "parentcaller": "0x7094e294", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*Windows*system32*config*systemprofile*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro" } ], "repeated": 0, "id": 4191 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094e548", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 4192 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x70950337", "parentcaller": "0x7094e3dc", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" } ], "repeated": 0, "id": 4193 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x7094feba", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000438" } ], "repeated": 0, "id": 4194 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x7094fed8", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4195 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x7094ff1a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xfe\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 4196 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094ff3f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4197 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cefe0", "parentcaller": "0x70950249", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4198 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cf02d", "parentcaller": "0x70950249", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4199 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cefe0", "parentcaller": "0x7095027e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4200 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cf02d", "parentcaller": "0x7095027e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 4201 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x7095029c", "category": "process", "api": "NtOpenProcessToken", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x000f01ff" }, { "name": "TokenHandle", "value": "0x00000000" } ], "repeated": 0, "id": 4202 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4203 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x7094e548", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0xfffffffc" } ], "repeated": 0, "id": 4204 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x709500eb", "parentcaller": "0x7095012f", "category": "filesystem", "api": "DeleteFileW", "status": false, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db" } ], "repeated": 0, "id": 4205 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4cb2b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4206 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 4207 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4208 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4209 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74b4cc85", "parentcaller": "0x74b4cacc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4210 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac34d", "parentcaller": "0x75f185a9", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "Global\\windows_shell_global_counters" } ], "repeated": 0, "id": 4211 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774b762b", "parentcaller": "0x75f18457", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04c60000" }, { "name": "SectionOffset", "value": "0x055fdfbc" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4212 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4ccc4", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4213 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 4214 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4215 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4cb2b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4216 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 4217 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4218 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4219 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74b4cc85", "parentcaller": "0x74b9cda0", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4220 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4ccc4", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4221 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 4222 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4223 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b48bd0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4224 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x6af67cbf", "parentcaller": "0x6af67e76", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 4225 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9b67", "parentcaller": "0x774a92be", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4226 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4227 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e051", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4228 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aa90c", "parentcaller": "0x75f1e191", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xc5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x1f\\x80\\xd8_ R\\xfb]}D\\x80\\x1a\\xd0\\xb5/.\\x83\\xe1\\x00\\x00)\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x002\\x005\\x007\\x009\\x00\\x15\\x00%\\x00w\\x00i\\x00n\\x00d\\x00i\\x00r\\x00%\\x00\\\\x00e\\x00x\\x00p\\x00l\\x00o\\x00r\\x00e\\x00r\\x00.\\x00e\\x00x\\x00e\\x00\\xaf\\x00\\x00\\x00\t\\x00\\x00\\xa0-\\x00\\x00\\x001SPS\\xe2\\x8aXF\\xbcL8C\\xbb\\xfc\\x13\\x93" }, { "name": "Length", "value": "407" } ], "repeated": 0, "id": 4229 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e118", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 10, "id": 4230 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4231 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4232 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4233 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4234 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4235 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" } ], "repeated": 0, "id": 4236 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4237 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" } ], "repeated": 0, "id": 4238 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4239 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder" } ], "repeated": 0, "id": 4240 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4241 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 4242 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4243 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 4244 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "{52205FD8-5DFB-447D-801A-D0B52F2E83E1}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}" } ], "repeated": 0, "id": 4245 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x75f171ea", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4246 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4247 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4248 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "NormalizeLinkNetPidls" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NormalizeLinkNetPidls" } ], "repeated": 0, "id": 4249 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x75f17bb5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4250 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4251 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4252 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e051", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 20, "id": 4253 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4254 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4255 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4256 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4257 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4258 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4259 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4260 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4261 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7094996e", "parentcaller": "0x74b9e828", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4262 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x709594b0", "parentcaller": "0x70959381", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4263 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x75f2334a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 4264 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f23366", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 1, "id": 4265 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4266 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4267 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4268 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4269 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4270 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4271 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4272 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4273 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4274 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}" } ], "repeated": 0, "id": 4275 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b48bd0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4276 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x6af67cbf", "parentcaller": "0x6af67e76", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00021401-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000214F9-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "lnkfile" } ], "repeated": 0, "id": 4277 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a9b67", "parentcaller": "0x774a92be", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4278 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4279 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e051", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4280 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aa90c", "parentcaller": "0x75f1e191", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "Buffer", "value": "L\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00F\\xdf@\\x00\\x00 \\x00\\x00\\x00\\x9f2\\xc3\\x06\\x00\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01r\\x96LY\\x80\\xed\\xdc\\x01\\x98\\xac@\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x02\\x14\\x00\\x1fP\\xe0O\\xd0 \\xea:i\\x10\\xa2\\xd8\\x08\\x00+00\\x9d\\x19\\x00/C:\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x001\\x00\\x00\\x00\\x00\\x00\\xbd\\\\xb9\\x01\\x11\\x00PROGRA~1\\x00\\x00t\\x00\t\\x00\\x04\\x00\\xef\\xbe\\x87O\\xdbI\\xbd\\\\xb9\\x01.\\x00\\x00\\x00>\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x00\\x00\\x00\\x00\\x00\\xea\\xc9'\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\x00\\x00@\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x007\\x008" }, { "name": "Length", "value": "2247" } ], "repeated": 0, "id": 4281 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e118", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 10, "id": 4282 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4283 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4284 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4285 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4286 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4287 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4288 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4289 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4290 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4291 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4292 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4293 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap" } ], "repeated": 0, "id": 4294 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": ".exe" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "program" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.exe" } ], "repeated": 0, "id": 4295 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7093820f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4296 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4297 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": ".exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe" } ], "repeated": 0, "id": 4298 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "application/x-msdownload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type" } ], "repeated": 0, "id": 4299 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x70938252", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 4300 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4301 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x709c4000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4302 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777f1f80", "parentcaller": "0x777d8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 4303 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4304 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\PROPSYS.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4305 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d97cc", "parentcaller": "0x777d92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004c8" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\propsys.dll.mui" } ], "repeated": 0, "id": 4306 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d97f4", "parentcaller": "0x777d92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e00000" }, { "name": "SectionOffset", "value": "0x055fc408" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4307 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777d9804", "parentcaller": "0x777d92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 4308 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4309 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 4310 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004cc" }, { "name": "ObjectAttributesName", "value": "FileAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation" } ], "repeated": 0, "id": 4311 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "ValueName", "value": "UseLocalMachineSoftwareClassesWhenImpersonating" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating" } ], "repeated": 0, "id": 4312 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "ValueName", "value": "UseLocalMachineSoftwareClassesWhenImpersonating" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Information", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating" } ], "repeated": 0, "id": 4313 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x761a692e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 4314 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4315 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Classes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004d0" }, { "name": "ObjectAttributesName", "value": ".exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe" } ], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d4" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "exefile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004d0" }, { "name": "ObjectAttributesName", "value": "exefile" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "CurVer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer" } ], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b54950", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004dc" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4324 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000430" }, { "name": "ObjectAttributesName", "value": "SystemFileAssociations\\.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "ShellEx\\IconHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xd4_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xeal\\xadt\\x0c\\xda_\\x05\\x13\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\xd6\\x00\\x00\\x04\\xb6\\xabt" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004e0" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004dc" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject" } ], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "DocObject" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace" } ], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004dc" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "BrowseInPlace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace" } ], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d4" }, { "name": "ValueName", "value": "Content Type" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "application/x-msdownload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004dc" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid" } ], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "Clsid" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\Clsid" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut" } ], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut" } ], "repeated": 0, "id": 4345 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt" } ], "repeated": 0, "id": 4346 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74b516c2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x75f44627", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e27c", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac218", "parentcaller": "0x75f1da84", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x10\\x14@\\x0f\\x00\\xef\\xdc\\x01(XK-X\\xef\\xdc\\x01\\xb5L|\\x08\\x00\\xef\\xdc\\x01\\x10\\x14@\\x0f\\x00\\xef\\xdc\\x01 \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774ac218", "parentcaller": "0x75f1da9e", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e6de", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 7, "id": 4357 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-29 10:44:51,034", "thread_id": "10280", "caller": "0x777f109f", "parentcaller": "0x777ef039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "LINKINFO.dll" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f213c", "parentcaller": "0x777f2046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\linkinfo.dll" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777fe65c", "parentcaller": "0x777fe3a8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\linkinfo.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777fe699", "parentcaller": "0x777fe3a8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\linkinfo.dll" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f122c", "parentcaller": "0x777f1397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f000f", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e8000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f00b7", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e7000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f00e5", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e7000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x77801ea8", "parentcaller": "0x77801e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x77801ea8", "parentcaller": "0x77801e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777d9d5b", "parentcaller": "0x777eb4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e7000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777fe6ed", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777fe6f5", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754e7000" }, { "name": "ModuleName", "value": "LINKINFO.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x754e0000" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777edd72", "parentcaller": "0x777f1873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\linkinfo" }, { "name": "BaseAddress", "value": "0x754e0000" }, { "name": "InitRoutine", "value": "0x754e26a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e16000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e16000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f1e051", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 56, "id": 4378 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b76dc2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "x=\\x94\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 4380 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74b750ae", "parentcaller": "0x74b78f11", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x8c\\xdd_\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4383 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x74bf852e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4387 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4388 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4391 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4395 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4396 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4399 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4400 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4401 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4403 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4404 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7782fcba", "parentcaller": "0x77808f3a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10276", "caller": "0x74c0470b", "parentcaller": "0x77809680", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74bd102d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xd3_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00T\\xd3_\\x05\\xe0\\xb2y\\x03\\xa0\\xe7}wp\\xd8_\\x05F\\x02\\x00\\x00\\xe0\\xb2y\\x03p\\xd8_\\x05" } ], "repeated": 0, "id": 4410 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004d0" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004dc" } ], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(\\xf7\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 4420 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbeAb\\xc8\\xde\\xac\\xd5\\x01C\\xfb\\xe1\\x17X\\xef\\xdc\\x01\\xb2\\x020C\\x00\\xef\\xdc\\x01\\xb2\\x020C\\x00\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00P\\x00R\\x00O\\x00G\\x00R\\x00A\\x00~\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc9\\x04\\x00\\x00\\x00\\x00\\x01\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00" }, { "name": "FileName", "value": "C:\\Program Files (x86)" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74ba59bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4cb2b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x00" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774cecdc", "parentcaller": "0x74b4cbc8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\desktop.ini" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aa90c", "parentcaller": "0x74b4cc11", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\desktop.ini" }, { "name": "Buffer", "value": "\\xff\\xfe\r\\x00\n\\x00[\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00f\\x00o\\x00]\\x00\r\\x00\n\\x00L\\x00o\\x00c\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00N\\x00a\\x00m\\x00e\\x00=\\x00@\\x00%\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00R\\x00o\\x00o\\x00t\\x00%\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00s\\x00h\\x00e\\x00l\\x00l\\x003\\x002\\x00.\\x00d\\x00l\\x00l\\x00,\\x00-\\x002\\x001\\x008\\x001\\x007\\x00\r\\x00\n\\x00" }, { "name": "Length", "value": "174" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ac218", "parentcaller": "0x74b4cc64", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004dc" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\desktop.ini" }, { "name": "FileInformationClass", "value": "4", "pretty_value": "FileBasicInformation" }, { "name": "FileInformation", "value": "\\x81n\\x9f\\xc9\\xde\\xac\\xd5\\x01\\x16\\xbdM-X\\xef\\xdc\\x01\\xab\\xb8,{\\xde\\xac\\xd5\\x01e\\x9e\\x95\\xc2\\xf8\\xee\\xdc\\x01&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b4cc7b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74b4cc85", "parentcaller": "0x74b4cacc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74c03915", "parentcaller": "0x74b4ccc4", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00`T\\x02,\\x17\\x00\\x00((\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10280" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774b70bc", "parentcaller": "0x74c03941", "category": "process", "api": "NtReadVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Size", "value": "0x00000001" }, { "name": "Buffer", "value": "\\x01" } ], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774cd361", "parentcaller": "0x74c0396f", "category": "process", "api": "NtWriteVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02546175" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x74b9cc56", "parentcaller": "0x74be93c2", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4437 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b75f46", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4438 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4439 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4440 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4441 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4442 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4443 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4444 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4445 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4446 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4447 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4448 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4449 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4450 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4451 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4452 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4453 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4454 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4455 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4456 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4457 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4458 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4459 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4460 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4461 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4462 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4463 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4464 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4465 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4466 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4467 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4468 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4469 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4470 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4471 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4472 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4473 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4474 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4475 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4476 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4477 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4478 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4479 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4480 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4481 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4482 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4483 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4484 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4485 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4486 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4487 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4488 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4489 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4490 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4491 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4492 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4493 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4494 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4495 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4496 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4497 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4498 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4499 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4500 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4501 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4502 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4503 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4504 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4505 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4506 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4507 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4508 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4509 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4510 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4511 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4512 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4513 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4514 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4515 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4516 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4517 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4518 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4519 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4520 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4521 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4522 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4523 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4524 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4525 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4526 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4527 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4528 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4529 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4530 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4531 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4532 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4533 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4534 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4535 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4536 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4537 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4538 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4539 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4540 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4541 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4542 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4543 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4544 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4545 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4546 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ac899", "parentcaller": "0x74cfcc8d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" } ], "repeated": 1, "id": 4547 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4548 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4549 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4550 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4551 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4552 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4553 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4554 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 4555 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x75f2334a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 4556 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x75f23366", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 1, "id": 4557 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4558 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4559 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4560 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4561 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4562 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4563 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4564 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4565 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4566 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 4567 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4568 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4569 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4570 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 4571 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 4572 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 4573 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x74b48bd0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4574 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774cab2e", "parentcaller": "0x6aec0920", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" } ], "repeated": 0, "id": 4575 }, { "timestamp": "2026-05-29 10:44:51,049", "thread_id": "10280", "caller": "0x774ac9d6", "parentcaller": "0x6aec64c7", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x028e9a38", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*" }, { "name": "FirstCreateTimeLow", "value": "0xaff228df" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceeb6" } ], "repeated": 0, "id": 4576 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c8cb8", "parentcaller": "0x6aec653a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4577 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774cab2e", "parentcaller": "0x6aec0920", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" } ], "repeated": 0, "id": 4578 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774ac9d6", "parentcaller": "0x6aec64c7", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x028e9538", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" }, { "name": "FirstCreateTimeLow", "value": "0xaff228df" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceeb6" } ], "repeated": 0, "id": 4579 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c8cb8", "parentcaller": "0x6aec653a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4580 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4581 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4582 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4583 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4584 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4585 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 4586 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4587 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegEnumKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed90" } ], "repeated": 0, "id": 4588 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4589 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4590 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4591 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "ConvertStringSidToSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e69b00" } ], "repeated": 0, "id": 4592 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4593 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4594 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4595 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4596 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "LookupAccountSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6eec0" } ], "repeated": 0, "id": 4597 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4598 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75ec5000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4599 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75ec5000" }, { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4600 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4601 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4602 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4603 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4604 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4605 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4606 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "lastrun" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun" } ], "repeated": 0, "id": 4607 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "lastrun" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "13424525062565861" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun" } ], "repeated": 0, "id": 4608 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee656f", "parentcaller": "0x6af07154", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4609 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4610 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4611 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4612 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4613 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4614 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4615 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4616 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4617 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4618 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4619 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4620 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4621 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4622 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4623 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "InactivityBadgeApplied" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InactivityBadgeApplied" } ], "repeated": 0, "id": 4624 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee6769", "parentcaller": "0x6af071d3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4625 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4626 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4627 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4628 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4629 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4630 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4631 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4632 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4633 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4634 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4635 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4636 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4637 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4638 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4639 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseen" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen" } ], "repeated": 0, "id": 4640 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseen" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "13424456007311642" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen" } ], "repeated": 0, "id": 4641 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseenversion" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion" } ], "repeated": 0, "id": 4642 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseenversion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion" } ], "repeated": 0, "id": 4643 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee69d8", "parentcaller": "0x6af07231", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4644 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4645 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4646 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4647 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4648 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4649 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4650 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4651 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4652 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4653 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4654 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4655 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4656 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4657 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4658 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseen" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen" } ], "repeated": 0, "id": 4659 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseen" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "13424456007311642" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen" } ], "repeated": 0, "id": 4660 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseenversion" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion" } ], "repeated": 0, "id": 4661 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "freseenversion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion" } ], "repeated": 0, "id": 4662 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee69d8", "parentcaller": "0x6af072af", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4663 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness" } ], "repeated": 0, "id": 4664 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000428" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{23C79A83-20A9-4FB0-83FD-22AA3FAE0A71}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness" } ], "repeated": 0, "id": 4665 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4666 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4667 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4668 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4669 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4670 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4671 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4672 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 4673 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4674 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af05c30", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 4675 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af05c51", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4676 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 4677 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4678 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774bd1fa", "parentcaller": "0x774a9744", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "EventName", "value": "Global\\EdgeUpdateUpdaterRunning{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "EventType", "value": "0" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 4679 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 4680 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4681 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xe1_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x80\\x00\\x00\\x00I\\x01\\x00\\x00\\x04\\x03:\\x03\\x01\\x00\\x00\\x00\\xd8\\xe9x\\x03L\\x00\\x00\\x00&\\x00\\x00\\x00\\x03+\\xffj\\x9e~\\x90\\x02h\\xbe\\x93\\x02L\\x00\\x00\\x00" } ], "repeated": 0, "id": 4682 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4683 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000408" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4684 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4685 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4686 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4687 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4688 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted" } ], "repeated": 0, "id": 4689 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4690 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4691 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv" } ], "repeated": 0, "id": 4692 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv" } ], "repeated": 0, "id": 4693 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang" } ], "repeated": 0, "id": 4694 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name" } ], "repeated": 0, "id": 4695 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Edge WebView2 Runtime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name" } ], "repeated": 0, "id": 4696 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4697 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000408" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4698 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4699 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4700 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4701 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4702 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4703 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4704 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4705 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4706 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4707 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4708 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4709 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4710 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4711 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4712 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4713 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4714 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4715 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4716 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4717 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4718 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\dr" } ], "repeated": 0, "id": 4719 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af1d6e3", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4720 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af1d3f2", "parentcaller": "0x6af05849", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4721 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000408" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4722 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang" } ], "repeated": 0, "id": 4723 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4724 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb369", "parentcaller": "0x6af051b2", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 1, "id": 4725 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af05163", "parentcaller": "0x6af058f0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4726 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ap" } ], "repeated": 0, "id": 4727 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken" } ], "repeated": 0, "id": 4728 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort" } ], "repeated": 0, "id": 4729 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)" } ], "repeated": 0, "id": 4730 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "rrf@0.53" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)" } ], "repeated": 0, "id": 4731 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "hint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint" } ], "repeated": 0, "id": 4732 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint" } ], "repeated": 0, "id": 4733 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name" } ], "repeated": 0, "id": 4734 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name" } ], "repeated": 0, "id": 4735 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee6e8b", "parentcaller": "0x6af05935", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4736 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "iid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\iid" } ], "repeated": 0, "id": 4737 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "brand" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand" } ], "repeated": 0, "id": 4738 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "brand" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "EUWV" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand" } ], "repeated": 0, "id": 4739 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "client" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\client" } ], "repeated": 0, "id": 4740 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "ActivePingDayStartSec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ActivePingDayStartSec" } ], "repeated": 0, "id": 4741 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779926400" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec" } ], "repeated": 0, "id": 4742 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6af046da", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4743 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4744 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4745 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4746 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4747 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4748 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4749 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4750 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "InstallTime" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779982264" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\InstallTime" } ], "repeated": 0, "id": 4751 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aee5eb5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4752 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee5f69", "parentcaller": "0x6af06f95", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4753 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "DayOfLastActivity" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "18446744073709551615" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastActivity" } ], "repeated": 0, "id": 4754 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall" } ], "repeated": 0, "id": 4755 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4756 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4757 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4758 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4759 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4760 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4761 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4762 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfInstall" } ], "repeated": 0, "id": 4763 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee613e", "parentcaller": "0x6af06ff8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4764 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4765 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4766 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4767 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4768 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4769 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4770 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4771 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "oobeinstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\oobeinstall" } ], "repeated": 0, "id": 4772 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee622b", "parentcaller": "0x6af0706f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4773 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4774 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4775 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4776 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4777 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4778 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4779 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4780 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "updatecount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatecount" } ], "repeated": 0, "id": 4781 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee62d4", "parentcaller": "0x6af070e3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4782 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4783 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4784 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4785 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4786 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4787 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4788 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4789 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4790 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4791 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4792 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4793 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4794 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4795 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4796 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4797 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4798 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4799 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4800 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4801 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4802 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4803 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4804 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4805 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4806 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4807 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4808 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4809 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4810 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4811 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4812 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4813 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4814 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4815 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4816 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4817 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4818 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4819 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4820 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4821 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4822 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4823 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4824 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4825 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4826 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4827 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4828 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4829 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4830 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4831 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4832 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4833 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4834 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4835 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4836 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4837 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4838 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness" } ], "repeated": 0, "id": 4839 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000408" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{13551C0C-5B21-4FE7-869F-3A0973E7DAF5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness" } ], "repeated": 0, "id": 4840 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4841 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4842 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4843 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4844 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4845 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4846 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4847 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 4848 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4849 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4850 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 4851 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51e2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4852 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4853 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af05c30", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 4854 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af05c51", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4855 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 4856 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4857 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774bd1fa", "parentcaller": "0x774a9744", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" }, { "name": "EventName", "value": "Global\\EdgeUpdateUpdaterRunning{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "EventType", "value": "0" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 4858 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 4859 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4860 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xe1_\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x80\\x00\\x00\\x00I\\x01\\x00\\x00\\x04\\x03:\\x03\\x01\\x00\\x00\\x00\\xd8\\xe9x\\x03L\\x00\\x00\\x00&\\x00\\x00\\x00\\x03+\\xffj\\xfeu\\x90\\x02\\x08\\xc0\\x93\\x02L\\x00\\x00\\x00" } ], "repeated": 0, "id": 4861 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4862 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004d8" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 4863 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4864 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 4865 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4866 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4867 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted" } ], "repeated": 0, "id": 4868 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 4869 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4870 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 4871 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.3.233.3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 4872 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang" } ], "repeated": 0, "id": 4873 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name" } ], "repeated": 0, "id": 4874 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ec" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Microsoft Edge Update" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name" } ], "repeated": 0, "id": 4875 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 4876 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4877 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4878 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4879 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4880 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4881 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4882 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4883 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4884 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4885 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4886 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4887 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4888 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4889 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4890 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4891 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4892 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4893 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4894 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4895 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4896 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4897 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\dr" } ], "repeated": 0, "id": 4898 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af1d6e3", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4899 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6af1d3f2", "parentcaller": "0x6af05849", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 4900 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4901 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang" } ], "repeated": 0, "id": 4902 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4903 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ap" } ], "repeated": 0, "id": 4904 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken" } ], "repeated": 0, "id": 4905 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" } ], "repeated": 0, "id": 4906 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)" } ], "repeated": 0, "id": 4907 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "rrf@0.45" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)" } ], "repeated": 0, "id": 4908 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "hint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint" } ], "repeated": 0, "id": 4909 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint" } ], "repeated": 0, "id": 4910 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name" } ], "repeated": 0, "id": 4911 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name" } ], "repeated": 0, "id": 4912 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x6aee6e8b", "parentcaller": "0x6af05935", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4913 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "iid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid" } ], "repeated": 0, "id": 4914 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "brand" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand" } ], "repeated": 0, "id": 4915 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "brand" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "INBX" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand" } ], "repeated": 0, "id": 4916 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "client" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client" } ], "repeated": 0, "id": 4917 }, { "timestamp": "2026-05-29 10:44:51,065", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ActivePingDayStartSec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ActivePingDayStartSec" } ], "repeated": 0, "id": 4918 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779926400" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec" } ], "repeated": 0, "id": 4919 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6af046da", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4920 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4921 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4922 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4923 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4924 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4925 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4926 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4927 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "InstallTime" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779981955" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime" } ], "repeated": 0, "id": 4928 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aee5eb5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4929 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aee5f69", "parentcaller": "0x6af06f95", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4930 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DayOfLastActivity" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastActivity" } ], "repeated": 0, "id": 4931 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall" } ], "repeated": 0, "id": 4932 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4933 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4934 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4935 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4936 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4937 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4938 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4939 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall" } ], "repeated": 0, "id": 4940 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aee613e", "parentcaller": "0x6af06ff8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4941 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4942 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4943 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4944 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4945 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4946 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4947 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4948 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "oobeinstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oobeinstall" } ], "repeated": 0, "id": 4949 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aee622b", "parentcaller": "0x6af0706f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4950 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4951 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4952 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4953 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4954 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4955 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4956 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4957 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "updatecount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatecount" } ], "repeated": 0, "id": 4958 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aee62d4", "parentcaller": "0x6af070e3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4959 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4960 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4961 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4962 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4963 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4964 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4965 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4966 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4967 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4968 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4969 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4970 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4971 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6480", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4972 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4973 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4974 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4975 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4976 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4977 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4978 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4979 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4980 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4981 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4982 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4983 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4984 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4985 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6622", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 4986 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4987 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 4988 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4989 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 4990 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 4991 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 4992 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 4993 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 4994 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 4995 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 4996 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 4997 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 4998 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 4999 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 5000 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5001 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 5002 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5003 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5004 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5005 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5006 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 5007 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 5008 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 5009 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 5010 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 5011 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 5012 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18" } ], "repeated": 0, "id": 5013 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aebd683", "parentcaller": "0x6aee6822", "category": "registry", "api": "RegEnumKeyW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x80000003" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 5014 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5015 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness" } ], "repeated": 0, "id": 5016 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d8" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{B870E696-85A1-478B-AC82-A079D930C77C}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness" } ], "repeated": 0, "id": 5017 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 5018 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5019 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5020 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5021 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5022 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 5023 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5024 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5025 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f0" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\usagestats" } ], "repeated": 0, "id": 5026 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51e2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 5027 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5028 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af05c30", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 5029 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6af05c51", "parentcaller": "0x6af22b4d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5030 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 5031 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 1, "id": 5032 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5033 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\xf4\\xef\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5034 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4\\xef\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5035 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\\xf4\\xef\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5036 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4\\xef\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5037 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x008\\x001\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x008\\x000\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 5038 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00C\\x00o\\x00n\\x00f\\x00i\\x00g\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00L\\x00o\\x00a\\x00d\\x00G\\x00r\\x00o\\x00u\\x00p\\x00P\\x00o\\x00l\\x00i\\x00c\\x00i\\x00e\\x00s\\x00]\\x00[\\x00M\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00 \\x00i\\x00s\\x00 \\x00n\\x00o\\x00t\\x00 \\x00E\\x00n\\x00t\\x00e\\x00r\\x00p\\x00r\\x00i\\x00s\\x00e\\x00 \\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 5039 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 5040 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 5041 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\Copilot" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Copilot" } ], "repeated": 0, "id": 5042 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5043 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5044 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00\\x0c\\xf1\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5045 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xf1\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5046 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00\\x0c\\xf1\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5047 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xf1\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5048 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x008\\x001\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x008\\x000\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 5049 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00C\\x00o\\x00p\\x00i\\x00l\\x00o\\x00t\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00s\\x00e\\x00t\\x00_\\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00[\\x00C\\x00o\\x00p\\x00i\\x00l\\x00o\\x00t\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00i\\x00s\\x00_\\x00m\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00a\\x00l\\x00l\\x00o\\x00w\\x00_\\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00a\\x00t\\x00i\\x00o\\x00n\\x00]\\x00[\\x000\\x00]\\x00]\\x00" }, { "name": "Length", "value": "178" } ], "repeated": 0, "id": 5050 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 5051 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 5052 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5053 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00L\\xf2\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5054 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\xf2\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5055 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00L\\xf2\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5056 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\xf2\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5057 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x008\\x001\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x008\\x000\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 5058 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00O\\x00m\\x00a\\x00h\\x00a\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00s\\x00e\\x00t\\x00_\\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00G\\x00r\\x00o\\x00u\\x00p\\x00 \\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00[\\x00C\\x00a\\x00c\\x00h\\x00e\\x00d\\x00O\\x00m\\x00a\\x00h\\x00a\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00i\\x00s\\x00_\\x00i\\x00n\\x00i\\x00t\\x00i\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00i\\x00s\\x00_\\x00m\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00a\\x00u\\x00t\\x00o\\x00_\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x00c\\x00h\\x00e\\x00c\\x00k\\x00_\\x00p\\x00e\\x00r\\x00i\\x00o\\x00d\\x00_\\x00m\\x00i\\x00" }, { "name": "Length", "value": "842" } ], "repeated": 0, "id": 5059 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 5060 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 5061 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecaf8a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5062 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5063 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegDeleteValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70470" } ], "repeated": 0, "id": 5064 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5065 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca0e1", "parentcaller": "0x6aecaf99", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "ValueName", "value": "InstallerProgress" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallerProgress" } ], "repeated": 0, "id": 5066 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecafa9", "parentcaller": "0x6af0f2ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5067 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5068 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 5069 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed7aee", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5070 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecaea3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5071 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5072 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted" } ], "repeated": 0, "id": 5073 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed2f83", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5074 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 5075 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecb032", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ec" }, { "name": "SubKey", "value": "CurrentState" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" } ], "repeated": 0, "id": 5076 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb0b2", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\" } ], "repeated": 0, "id": 5077 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb0c6", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 5078 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5079 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegDeleteKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f330" } ], "repeated": 0, "id": 5080 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5081 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0920", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\license.rtf" } ], "repeated": 0, "id": 5082 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca0b1", "parentcaller": "0x6aecb0da", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "SubKey", "value": "CurrentState" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" } ], "repeated": 0, "id": 5083 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecaee7", "parentcaller": "0x6af20335", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5084 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecaf8a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5085 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca0e1", "parentcaller": "0x6aecaf99", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "ValueName", "value": "InstallerProgress" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallerProgress" } ], "repeated": 0, "id": 5086 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecafa9", "parentcaller": "0x6af0f2ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5087 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecaea3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5088 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca333", "parentcaller": "0x6aecb032", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ec" }, { "name": "SubKey", "value": "CurrentState" }, { "name": "Handle", "value": "0x000004d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" } ], "repeated": 0, "id": 5089 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb0b2", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState\\" } ], "repeated": 0, "id": 5090 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecb0c6", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 5091 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca0b1", "parentcaller": "0x6aecb0da", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" }, { "name": "SubKey", "value": "CurrentState" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" } ], "repeated": 0, "id": 5092 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecaee7", "parentcaller": "0x6af20335", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5093 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 5094 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5095 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f869c1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5096 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f8684c", "category": "system", "api": "NtClose", "status": false, "return": "0xffffffffc0000008", "pretty_return": "INVALID_HANDLE", "arguments": [ { "name": "Handle", "value": "0x00000000" } ], "repeated": 0, "id": 5097 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774aab1a", "parentcaller": "0x76f86668", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 5098 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 5099 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5100 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5101 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5102 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5103 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5104 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5105 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted" } ], "repeated": 0, "id": 5106 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5107 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5108 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "oeminstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oeminstall" } ], "repeated": 0, "id": 5109 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6af04b84", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5110 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5111 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 5112 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5113 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5114 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5115 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5116 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5117 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5118 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted" } ], "repeated": 0, "id": 5119 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5120 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5121 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x766f12f8", "parentcaller": "0x766f0561", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 5122 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004f8" } ], "repeated": 0, "id": 5123 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5124 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "t\\xf4\\x95\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00l\\x00i\\x00c\\x00e\\x00n\\x00s\\x00e\\x00.\\x00r\\x00t\\x00f\\x00\\x00\\x00" } ], "repeated": 0, "id": 5125 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "X5\\x95\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00d\\x00e\\x00s\\x00k\\x00t\\x00o\\x00p\\x00.\\x00i\\x00n\\x00i\\x00" } ], "repeated": 0, "id": 5126 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5127 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x94*\\x96\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 5128 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5129 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "D@\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5130 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00@@\\x94\\x02\\x00\\x00#\\x00\\x9c\\xe0\\x90\\xe0\\xf8\\x04\\x00\\x00d\\x01\\x00\\x00\\x00\\x00\\x8c\\x02#\\x00\\x00\\xc0\\xf8\\x04\\x00\\x00\\xe4\\xe0_\\x05\\xb3\\x91\\x7fw\\xf8\\x04\\x00\\x00" } ], "repeated": 0, "id": 5131 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j4\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9jdD\\xdb\\xc4\\x8c\\xdb_\\x05\\xf8\\x04\\x00\\x00H\\xeb_\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\x9c\\xe0_\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 5132 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "OS\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5133 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "d\\xf5\\x95\\x02\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5134 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe00\\x95\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00L\\x00O\\x00C\\x00A\\x00L\\x00 \\x00S\\x00E\\x00R\\x00V\\x00I\\x00C\\x00E\\x00\\x00\\x00\\x081\\x95\\x02\\xd80\\x95\\x02\\x081\\x95\\x02\\x00\\x00\\x00\\x00LMEM@\\x00\\x00\\x00\\xb0\\xdd_\\x05" } ], "repeated": 0, "id": 5135 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5136 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x0c+\\x96\\x02\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 5137 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5138 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf4A\\x94\\x02\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5139 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5140 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3j4\\xc3y\\x03d\\x01t\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x1cz\\xdb\\xc4t\\xd9_\\x05\\xf8\\x04\\x00\\x00H\\xeb_\\x05\\xa0\\xe6\\xd0j\\x00\\x05X\\xab\\xfe\\xff\\xff\\xff\\x84\\xde_\\x05\\x96\\x19\\xbdjG\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 5141 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted" } ], "repeated": 0, "id": 5142 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3b29", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5143 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5144 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "ValueName", "value": "oeminstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oeminstall" } ], "repeated": 0, "id": 5145 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6af04b84", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5146 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6aef8223", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5147 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5148 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 5149 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed7aee", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5150 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 5151 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 5152 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6aed286f", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5153 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed2895", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5154 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 5155 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 5156 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5157 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed2895", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5158 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5159 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 5160 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5161 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 5162 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 5163 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51e2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5164 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5165 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed28dd", "parentcaller": "0x6aed9fd6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5166 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5167 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5168 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aed9ff4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5169 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5170 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegCreateKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ee60" } ], "repeated": 0, "id": 5171 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5172 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x000004f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 5173 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5174 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegSetValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ee20" } ], "repeated": 0, "id": 5175 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5176 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "2" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 5177 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 5178 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5179 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "4" }, { "name": "FunctionAddress", "value": "0x7682f9e0" } ], "repeated": 0, "id": 5180 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5181 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5182 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "6" }, { "name": "FunctionAddress", "value": "0x7682ec30" } ], "repeated": 0, "id": 5183 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5184 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5185 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "2" }, { "name": "FunctionAddress", "value": "0x7682fa70" } ], "repeated": 0, "id": 5186 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5187 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5188 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "149" }, { "name": "FunctionAddress", "value": "0x76826520" } ], "repeated": 0, "id": 5189 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5190 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" } ], "repeated": 0, "id": 5191 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6aed9534", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "1" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5192 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x75604a49", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7562c000" }, { "name": "ModuleName", "value": "psmachine.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5193 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "283" }, { "name": "FunctionAddress", "value": "0x768249e0" } ], "repeated": 0, "id": 5194 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed9570", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "2" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 5195 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x774c7efa", "parentcaller": "0x75604a49", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7562c000" }, { "name": "ModuleName", "value": "psmachine.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5196 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aed95ba", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x00000498" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 5197 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 5198 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 5199 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5200 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed968e", "parentcaller": "0x6aed99b8", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000004a8" }, { "name": "IoControlCode", "value": "0x00170002" }, { "name": "InBuffer", "value": "\\x01\\x01\\x01\\x01" }, { "name": "OutBuffer", "value": "\\x00\\x1b!:|\\xd4" } ], "repeated": 0, "id": 5201 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aed9712", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 5202 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed974f", "parentcaller": "0x6aed99b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5203 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9798", "parentcaller": "0x6aed99b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5204 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecac4a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5205 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecac5a", "parentcaller": "0x6aed9a36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5206 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5207 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aed9a85", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ABshOnzU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU" } ], "repeated": 0, "id": 5208 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9b67", "parentcaller": "0x6aec58ed", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5209 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5210 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9b9c", "parentcaller": "0x6aed9aa2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "old-uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid" } ], "repeated": 0, "id": 5211 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5212 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "ValueName", "value": "uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{FF7E44AB-182C-4237-80DB-F58260993716}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5213 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecab5b", "parentcaller": "0x6aecabc5", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "old-uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{FF7E44AB-182C-4237-80DB-F58260993716}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid" } ], "repeated": 0, "id": 5214 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aecabd8", "category": "registry", "api": "RegDeleteValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5215 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5216 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 5217 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed7aee", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 5218 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9b67", "parentcaller": "0x6aec58ed", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5219 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000434" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 5220 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9d73", "parentcaller": "0x6aed9c14", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5221 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aed9db4", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{BEFBCB77-63F8-429E-8863-F0DC8214DEE6}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5222 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aed9c7b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5223 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aed9c9b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "uid-create-time" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780051491" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time" } ], "repeated": 0, "id": 5224 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "ValueName", "value": "uid-num-rotations" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations" } ], "repeated": 0, "id": 5225 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aed9cc0", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "uid-num-rotations" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "2" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations" } ], "repeated": 0, "id": 5226 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" }, { "name": "Handle", "value": "0x000004e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" } ], "repeated": 0, "id": 5227 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6aed9534", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "1" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 5228 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed9570", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "2" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 5229 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aed95ba", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e8" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 5230 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 5231 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 5232 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5233 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed968e", "parentcaller": "0x6aed9ddf", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000004d0" }, { "name": "IoControlCode", "value": "0x00170002" }, { "name": "InBuffer", "value": "\\x01\\x01\\x01\\x01" }, { "name": "OutBuffer", "value": "\\x00\\x1b!:|\\xd4" } ], "repeated": 0, "id": 5234 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aed9712", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 5235 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed974f", "parentcaller": "0x6aed9ddf", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5236 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9798", "parentcaller": "0x6aed9ddf", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5237 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9b67", "parentcaller": "0x6aec58ed", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5238 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecaea3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate" } ], "repeated": 0, "id": 5239 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecb032", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004dc" }, { "name": "SubKey", "value": "uid" }, { "name": "Handle", "value": "0x000004d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5240 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb0b2", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\" } ], "repeated": 0, "id": 5241 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecb0c6", "parentcaller": "0x6aecaebb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 5242 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca0b1", "parentcaller": "0x6aecb0da", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "SubKey", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5243 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecaee7", "parentcaller": "0x6aed98be", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5244 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000206", "pretty_value": "KEY_SET_VALUE|KEY_CREATE_SUB_KEY|0x00000200" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 5245 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aed990b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ABshOnzU" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU" } ], "repeated": 0, "id": 5246 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed993f", "parentcaller": "0x6aed9e06", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5247 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 1, "id": 5248 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9e78", "parentcaller": "0x6aed9c14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5249 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 1, "id": 5250 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9c2b", "parentcaller": "0x6aed9aa2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 5251 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 1, "id": 5252 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aed9aba", "parentcaller": "0x6aeda006", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5253 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5254 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5255 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{BEFBCB77-63F8-429E-8863-F0DC8214DEE6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 5256 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5257 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 2, "id": 5258 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 5259 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 1, "id": 5260 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af64af4", "parentcaller": "0x6af5da3c", "category": "misc", "api": "GlobalMemoryStatusEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "MemoryLoad", "value": "16" }, { "name": "TotalPhysicalMB", "value": "8191" } ], "repeated": 0, "id": 5261 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5262 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5263 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "PathGetDriveNumberW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76197310" } ], "repeated": 0, "id": 5264 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5265 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5266 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aec8a92", "parentcaller": "0x6af64b85", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000004a4" }, { "name": "IoControlCode", "value": "0x002d1400", "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY" }, { "name": "InBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa6\\x8e\\x028@\\x95\\x02{\\x10\\x190t\\xf8K\\x05\\x85K\\xf6j$\\xba\\x93\\x02\\xcc\\xf8K\\x058\\xf9K\\x05\\xf7w\\xebj$\\xba\\x93\\x02\\x90\\x82\\x90\\x02\\x00\\x00\\x00\\x00{\\xff\\xffA\\x18\\xc4\\x01\\x00\\x0c\\xba\\x93\\x02@\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\xb0\\xf7\\xff\\x01\\x00\\x00\\x00\\x00@Y\\xac\\x01\\x00\\x00\\x00\\x00\\xb0\\xf7w\\x02\\x00\\x00\\x00\\x00\\xc0\t\\xb7\\x01\\x00\\x00\\x00\\x00\\x00\\xfe\\x7f\\x00\\x00\\x00\\x00\\x00@jw\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xf8K\\x05\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x10\\xf8K\\x05\\x10\\xf8K\\x05\\xbdv\\xebj&\\x00\\x00\\x00<\\xf8K\\x05\\xa0\\xf8K\\x058\\xf9K\\x05\\x18\\xc4\\x93\\x02\\xd2%!\\xcd(\\xf8K\\x05^u\\xebj<\\xf8K\\x05&\\x00\\x00\\x00\\xa0\\xf8K\\x05\\xa4\\xf8K\\x05\\x90\\xf8K\\x054\\xd4\\xebj<\\xf8K\\x05\\xb4\\xf8K\\x05B\\xd4\\xebj{\\x003\\x00F\\x00C\\x00B\\x003\\x006\\x00C\\x00" } ], "repeated": 0, "id": 5267 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aec8ad0", "parentcaller": "0x6af64b85", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000004a4" }, { "name": "IoControlCode", "value": "0x002d1400", "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY" }, { "name": "InBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x0c\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5268 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8ae9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5269 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af64baa", "parentcaller": "0x6af5da3c", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5270 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 5271 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x777a0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 5272 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlGetVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777cff50" } ], "repeated": 0, "id": 5273 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x6aec6103", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5274 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 5275 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "UBR" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 5276 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed8958", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5277 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a917f", "parentcaller": "0x6aec600a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 5278 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774af140" } ], "repeated": 0, "id": 5279 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5280 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780d4ea", "parentcaller": "0x774d12da", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5281 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780d524", "parentcaller": "0x774d12da", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfoLegacyMapping" }, { "name": "Type", "value": "0x00000003" } ], "repeated": 0, "id": 5282 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aebe0ae", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\WindowsSelfHost\\Applicability" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfHost\\Applicability" } ], "repeated": 0, "id": 5283 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "EnablePreviewBuilds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds" } ], "repeated": 0, "id": 5284 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aebe10f", "parentcaller": "0x6af64ca2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5285 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" }, { "name": "BaseAddress", "value": "0x74a30000" } ], "repeated": 0, "id": 5286 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74a30000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\wldp.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 5287 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "ModuleHandle", "value": "0x74a30000" }, { "name": "FunctionName", "value": "WldpQueryWindowsLockdownMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74a37dd0" } ], "repeated": 0, "id": 5288 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x74a37e12", "parentcaller": "0x6af64cff", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 5289 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 5290 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "SystemManufacturer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ], "repeated": 0, "id": 5291 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "SystemManufacturer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "ASUS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ], "repeated": 0, "id": 5292 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5293 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 5294 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "SystemProductName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName" } ], "repeated": 0, "id": 5295 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "SystemProductName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PRIME B450M-A II" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName" } ], "repeated": 0, "id": 5296 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5297 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 5298 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af3a9e8", "parentcaller": "0x6af3ab06", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x028c1b18", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc" } ], "repeated": 0, "id": 5299 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6af5d81d", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0295c530", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5300 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02924080", "arguments": [ { "name": "CommandLine", "value": "prog.exe" }, { "name": "NumArgs", "value": "1" } ], "repeated": 0, "id": 5301 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0295f380", "arguments": [ { "name": "CommandLine", "value": "prog.exe /c [/nocrashserver" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 5302 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02967358", "arguments": [ { "name": "CommandLine", "value": "prog.exe /crashhandler" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5303 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02959dc0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /svc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5304 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02968418", "arguments": [ { "name": "CommandLine", "value": "prog.exe /medsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5305 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02968028", "arguments": [ { "name": "CommandLine", "value": "prog.exe /regsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5306 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9438", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5307 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0296a000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5308 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9778", "arguments": [ { "name": "CommandLine", "value": "prog.exe /regserver" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5309 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9638", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregserver" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5310 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x029680d0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /crash" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5311 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9778", "arguments": [ { "name": "CommandLine", "value": "prog.exe -Embedding" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5312 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02968418", "arguments": [ { "name": "CommandLine", "value": "prog.exe /broker" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5313 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9938", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ondemand" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5314 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02950d88", "arguments": [ { "name": "CommandLine", "value": "prog.exe /install extra [/appargs appargs [/installsource src [/silent [/eularequired [/oem [/installelevated [/sessionid sid [/enterprise" }, { "name": "NumArgs", "value": "14" } ], "repeated": 0, "id": 5315 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02948c68", "arguments": [ { "name": "CommandLine", "value": "prog.exe /update [/sessionid sid [/selfrepair" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 5316 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02950d88", "arguments": [ { "name": "CommandLine", "value": "prog.exe /handoff extra [/appargs appargs [/installsource src [/silent [/eularequired [/offlineinstall [/offlinedir dir [/sessionid sid [/enterprise" }, { "name": "NumArgs", "value": "15" } ], "repeated": 0, "id": 5317 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0294f938", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ua [/installsource source [/machine [/critical" }, { "name": "NumArgs", "value": "6" } ], "repeated": 0, "id": 5318 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0294f938", "arguments": [ { "name": "CommandLine", "value": "prog.exe /report filename [/machine [/custom_info_filename customfilename" }, { "name": "NumArgs", "value": "6" } ], "repeated": 0, "id": 5319 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028f3830", "arguments": [ { "name": "CommandLine", "value": "prog.exe /report /i filename [/machine" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 5320 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x02953448", "arguments": [ { "name": "CommandLine", "value": "prog.exe /recover repairfile" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 5321 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0293c060", "arguments": [ { "name": "CommandLine", "value": "prog.exe /recover /machine repairfile" }, { "name": "NumArgs", "value": "4" } ], "repeated": 0, "id": 5322 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9778", "arguments": [ { "name": "CommandLine", "value": "prog.exe /uninstall" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5323 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0294f938", "arguments": [ { "name": "CommandLine", "value": "prog.exe /registerproduct extraargs [/installsource source" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 5324 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0293bc50", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregisterproduct extraargs" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 5325 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0295f380", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ping pingstring" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 5326 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x028e9638", "arguments": [ { "name": "CommandLine", "value": "prog.exe /healthcheck" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 5327 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x6af38348", "parentcaller": "0x6afd09d4", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0294f938", "arguments": [ { "name": "CommandLine", "value": "prog.exe /browserreplacement [/installsource source [/machine" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 5328 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5329 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x74b669b7", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000e" }, { "name": "TokenHandle", "value": "0x000004a4" } ], "repeated": 0, "id": 5330 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x74b669b7", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000e" }, { "name": "TokenHandle", "value": "0x00000498" } ], "repeated": 0, "id": 5331 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 1, "id": 5332 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74b66a9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5333 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74b66ab2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5334 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780f53f", "parentcaller": "0x77731ae1", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 5335 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780f55e", "parentcaller": "0x77731ae1", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "packageContents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents" } ], "repeated": 0, "id": 5336 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780f97a", "parentcaller": "0x7780f68c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xefK\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x1d\\x008?\\x92\\x02\\xf0C\\x92\\x02h\\xef\\x8f\\x02\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5337 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7780f6c9", "parentcaller": "0x77731ae1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5338 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74bf0bef", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5339 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74bf0c33", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\x01\\x95\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 5340 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5341 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\x02\\x96\\x02 \\x00 \\x00|\\x02\\x96\\x02\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\x02\\x96\\x02T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00PS\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5342 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18s\\x96\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5343 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74c12972", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5344 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00p\\x96\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5345 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74c12972", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5346 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x74b750ae", "parentcaller": "0x74b78a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5347 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b7516a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(\\xedK\\x05`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5348 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000290" }, { "name": "ObjectAttributesName", "value": "SessionInfo\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0" } ], "repeated": 0, "id": 5349 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8q\\x96\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5350 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5351 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5352 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004a4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5353 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74c03649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5354 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "ValueName", "value": "{A520A1A4-1780-4FF6-BD18-167343C5AF16}" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}" } ], "repeated": 0, "id": 5355 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5356 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 5357 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 5358 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 5359 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5360 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5361 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 5362 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 5363 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Public" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 5364 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5365 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5366 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Control\\Session Manager\\Environment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment" } ], "repeated": 0, "id": 5367 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "KeyInformation", "value": "u\\xff8c-\\xff82\\xfff1\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00,\\x00\\x00\\x00\\x16\\x01\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 5368 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5369 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5370 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5371 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5372 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5373 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5374 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5375 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5376 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5377 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5378 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5379 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5380 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5381 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5382 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5383 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5384 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5385 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5386 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5387 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5388 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5389 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5390 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5391 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 5392 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 5393 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 5394 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5395 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ab021", "parentcaller": "0x774c82ca", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 5396 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ac899", "parentcaller": "0x774c82d9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 5397 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ab021", "parentcaller": "0x774c8638", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 5398 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5399 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5400 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5401 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5402 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5403 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5404 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5405 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5406 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 5407 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 5408 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Default" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%SystemDrive%\\Users\\Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 5409 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188632", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5410 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5411 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5412 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 5413 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 5414 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5415 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5416 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5417 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 5418 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 5419 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5420 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5421 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5422 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 5423 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 5424 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5425 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5426 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5427 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 5428 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 5429 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5430 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5431 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5432 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 5433 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 5434 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5435 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5436 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 5437 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 5438 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Program Files\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 5439 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x741866de", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5440 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74189617", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18\\x10\\x93\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5441 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5442 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 5443 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5444 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 5445 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5446 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5447 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5448 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5449 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5450 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "ValueName", "value": "AppData" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 5451 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "ValueName", "value": "AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 5452 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5453 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 5454 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5455 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5456 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5457 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5458 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x74189048", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000434" } ], "repeated": 0, "id": 5459 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7418909e", "parentcaller": "0x74188b4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5460 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5461 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "DesiredAccess", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 5462 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 5463 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 5464 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5465 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 5466 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5467 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5468 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5469 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5470 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5471 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5472 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE" } ], "repeated": 0, "id": 5473 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000434" }, { "name": "ObjectAttributesName", "value": "DefaultUserEnviroment" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\DefaultUserEnviroment" } ], "repeated": 0, "id": 5474 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5475 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004a4" }, { "name": "ObjectAttributesName", "value": "Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Environment" } ], "repeated": 0, "id": 5476 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "KeyInformation", "value": "#p\\xff80\\xffd1\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00f\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 5477 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5478 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5479 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5480 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5481 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5482 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 5483 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 5484 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004a4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Volatile Environment" } ], "repeated": 0, "id": 5485 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004a4" }, { "name": "ObjectAttributesName", "value": "Volatile Environment\\0" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Volatile Environment\\0" } ], "repeated": 0, "id": 5486 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x7418954e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 5487 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x75088afd", "parentcaller": "0x7508deb5", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x000T\\x02,\\x17\\x00\\x00$(\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10276" } ], "repeated": 0, "id": 5488 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x7418b693", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5489 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x74b6f13d", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0n\\x96\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5490 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5491 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 5492 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5493 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 5494 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74188903", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 5495 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774a040b", "parentcaller": "0x74b759ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 5496 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5497 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\x02\\x96\\x02 \\x00 \\x00|\\x02\\x96\\x02\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\x02\\x96\\x02T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00PS\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5498 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774c952b", "parentcaller": "0x75f28561", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x000T\\x02,\\x17\\x00\\x00$(\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10276" } ], "repeated": 0, "id": 5499 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774c952b", "parentcaller": "0x75f4e4f6", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x90T\\x02,\\x17\\x00\\x00H(\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 1, "id": 5500 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 2, "id": 5501 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x76f54f05", "parentcaller": "0x76f54d82", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5502 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5503 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74b66e4e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 5504 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x74b66e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 5505 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x76f11171", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000002" }, { "name": "TokenHandle", "value": "0x000004f8" } ], "repeated": 0, "id": 5506 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x76f1123b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 5507 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10276", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 5508 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774a9278", "parentcaller": "0x76f86c28", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004fc" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5932" } ], "repeated": 0, "id": 5509 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774ac134", "parentcaller": "0x74b669b7", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000e" }, { "name": "TokenHandle", "value": "0x00000500" } ], "repeated": 0, "id": 5510 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 5511 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774a9e76", "parentcaller": "0x74b66b81", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 5512 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774b9924", "parentcaller": "0x74b66be2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000508" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5513 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74b66a9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 5514 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74b66ab2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 5515 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774a9278", "parentcaller": "0x76f86c28", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5932" } ], "repeated": 0, "id": 5516 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10312", "caller": "0x774c952b", "parentcaller": "0x75f28561", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x90T\\x02,\\x17\\x00\\x00H(\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10312" } ], "repeated": 0, "id": 5517 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774c952b", "parentcaller": "0x75f4e4f6", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0T\\x02,\\x17\\x00\\x00\\(\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 5518 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774abfb3", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5519 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774abfef", "parentcaller": "0x774ce664", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xec\\x8f\\x95\\x02 \\x00 \\x00\\x04\\x90\\x95\\x02\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00(\\x90\\x95\\x02T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00PS\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5520 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bf0bef", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5521 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bf0c33", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xff\\x94\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 5522 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x774abf45", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000004fc" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000050c" } ], "repeated": 0, "id": 5523 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774abfb3", "parentcaller": "0x774abf5f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 5524 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774abfef", "parentcaller": "0x774abf5f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xec\\x8f\\x95\\x02 \\x00 \\x00\\x04\\x90\\x95\\x02\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00(\\x90\\x95\\x02T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00PS\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5525 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774abf6f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 5526 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5527 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 5528 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000050c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000510" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5529 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10280", "caller": "0x74c0470b", "parentcaller": "0x77809680", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 5530 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 5531 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd102d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5532 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000510" } ], "repeated": 0, "id": 5533 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(\\xf7\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5534 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5535 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5536 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 5537 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01\\xbf\\x9b_\\x16X\\xef\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\xfc\\x07\\x87\\xc3\\xb8\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x06\\x00\\x00\\x00\\x00\\x01\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 5538 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74ba59bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5539 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5540 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 5541 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\xean:\\xdd\\xac\\xd5\\x01Q\\x17x+X\\xef\\xdc\\x01Q\\x17x+X\\xef\\xdc\\x01Q\\x17x+X\\xef\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe3\\x0c\\x00\\x00\\x00\\x00\\x01\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 5542 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74ba59bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5543 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5544 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774ac218", "parentcaller": "0x74ba5b7a", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\Windows\\SysWOW64" }, { "name": "FileInformationClass", "value": "55", "pretty_value": "FileReplaceCompletionInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 5545 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x74ba5c1c", "parentcaller": "0x74ba5996", "category": "filesystem", "api": "NtQueryDirectoryFile", "status": false, "return": "0xffffffffc000000f", "pretty_return": "NO_SUCH_FILE", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "FileInformation", "value": "" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\IntegratedServicesRegionPolicySet.json" }, { "name": "FileInformationClass", "value": "37", "pretty_value": "FileIdBothDirectoryInformation" } ], "repeated": 0, "id": 5546 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74be7069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5547 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\IntegratedServicesRegionPolicySet.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5548 }, { "timestamp": "2026-05-29 10:44:51,081", "thread_id": "10332", "caller": "0x74b67198", "parentcaller": "0x74bfaa30", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "934D4698-6A59-48F8-9F29-9FB30670320E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "71D222E1-432F-429E-8C13-B6DAFDE5077A" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 5549 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x74b7b89b", "parentcaller": "0x74b7b160", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5550 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5551 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 5552 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000510" }, { "name": "KeyInformation", "value": "\\xffd0\\x14\\xffde$\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 5553 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a040b", "parentcaller": "0x74b581bf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5554 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0296f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5555 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aba8f", "parentcaller": "0x774ab72c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\system32\\" } ], "repeated": 0, "id": 5556 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abb06", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5557 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5558 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5559 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abb4e", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5560 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abbca", "parentcaller": "0x774ab72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5561 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab788", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\system32\\" } ], "repeated": 0, "id": 5562 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab788", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5563 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "HandleName", "value": "C:\\Windows\\SysWOW64" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 5564 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab788", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5565 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000510" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5566 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 5567 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aba8f", "parentcaller": "0x774ab72c", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\" } ], "repeated": 0, "id": 5568 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abb06", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5569 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5570 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5571 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abb4e", "parentcaller": "0x774ab72c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5572 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774abbca", "parentcaller": "0x774ab72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5573 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab788", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\Windows\\" } ], "repeated": 0, "id": 5574 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab788", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5575 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc000000d", "pretty_return": "INVALID_PARAMETER", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "HandleName", "value": "C:\\Windows" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 5576 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab788", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5577 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a89c1", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5578 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774a8a18", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5579 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab0ce", "parentcaller": "0x774ab846", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 5580 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab181", "parentcaller": "0x774ab846", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5581 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab1b1", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "HandleName", "value": "\\Device\\HarddiskVolume2" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 5582 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ab1bf", "parentcaller": "0x774ab846", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5583 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5584 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab33a", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 5585 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9310", "parentcaller": "0x774ab33a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d4" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutputBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 5586 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x774ab34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5587 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 5588 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 5589 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004d4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5590 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x74c0470b", "parentcaller": "0x77809680", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 5591 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5592 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd102d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 5593 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774ac134", "parentcaller": "0x74bd29a2", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004e4" } ], "repeated": 0, "id": 5594 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x74bd2a6a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xef\\x91\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5595 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74bd29bb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 5596 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774b9924", "parentcaller": "0x74b60720", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000004d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5597 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x7748e3f2", "parentcaller": "0x74c046c9", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 5598 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x7748e455", "parentcaller": "0x74c046c9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 5599 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x774cd3de", "parentcaller": "0x7748e474", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e0" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 5600 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x7748e4aa", "parentcaller": "0x74c046c9", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x000004e0" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0xb34c3674" } ], "repeated": 0, "id": 5601 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10280", "caller": "0x7748e4b5", "parentcaller": "0x74c046c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 5602 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6076c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 5603 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b6082d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 5604 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x74c384bc", "parentcaller": "0x74c38d25", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "18907F3B-9AFB-4F87-B764-F9A4E16A21B8" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "522E34A4-07F7-40A1-94D0-1BFE832EFC3A" }, { "name": "ProgID", "value": "" } ], "repeated": 7, "id": 5605 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x76f38cc3", "parentcaller": "0x76f38b45", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 5606 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x76f18ca5", "parentcaller": "0x76fb2c0e", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5607 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774a9e76", "parentcaller": "0x76f16631", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x000\\xf6\\x96\\x026\\x007\\x00c\\x003\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x02d\\x00\\x00\\x00\\xd7\\x00\\x00\\x00P\\xf9\\x95\\x02\\x00\\x00\\x00\\x008\\x001\\x00c\\x00d\\x002\\x00c\\x003\\x005\\x00^e\\xf1v\\xec\\xe4\\xa8\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5608 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x74be8c8c", "parentcaller": "0x74be8a85", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5609 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66e4e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 5610 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 5611 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x74b66ea6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 5612 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774aab1a", "parentcaller": "0x76f2c435", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 5613 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x7559ddd8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 5614 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10332", "caller": "0x774c952b", "parentcaller": "0x75f1d09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0T\\x02,\\x17\\x00\\x00\\(\\x00\\x00?\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10332" } ], "repeated": 0, "id": 5615 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x76f8187d", "parentcaller": "0x76f80f43", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00020086" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 5616 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10312", "caller": "0x774aab1a", "parentcaller": "0x74bc7f26", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 5617 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x755a67ef", "parentcaller": "0x755a80ee", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" }, { "name": "MutexName", "value": "Local\\SM0:5932:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 5618 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x755a704e", "parentcaller": "0x755a4a7e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5619 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x755a9b3e", "parentcaller": "0x755a80ee", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 1, "id": 5620 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x755a882d", "parentcaller": "0x755a9bd4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5621 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x76f18ca5", "parentcaller": "0x76fb674b", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [ { "name": "Status", "value": "Log limit reached" } ], "repeated": 0, "id": 5622 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x76f16631", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x009\\x006\\x00b\\x00f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8.\\x97\\x02\\x03r\\xf1v\\xe0\\xebK\\x0563\\xf9v\\x00\\x00\\x8c\\x020\\x007\\x007\\x00f\\x002\\x00a\\x00c\\x003\\x00^e\\xf1v4\\xecK\\x05\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5623 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 5624 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00$\\xf6\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5625 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\xf6\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5626 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00 \n\\x00\\x00\\x00\\x00\\x00$\\xf6\t\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5627 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\xf6\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 5628 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a948c", "parentcaller": "0x6aeb9aec", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x001\\x00.\\x000\\x009\\x007\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x005\\x009\\x003\\x002\\x00:\\x001\\x000\\x002\\x007\\x006\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 5629 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a948c", "parentcaller": "0x6aeb9b5e", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00I\\x00s\\x00E\\x00d\\x00g\\x00e\\x00U\\x00n\\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00a\\x00b\\x00l\\x00e\\x00P\\x00e\\x00r\\x00R\\x00e\\x00g\\x00i\\x00o\\x00n\\x00a\\x00l\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x000\\x00]\\x00" }, { "name": "Length", "value": "82" } ], "repeated": 0, "id": 5630 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a948c", "parentcaller": "0x6aeb9bcb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 5631 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 5632 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6af3a833", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Control Panel\\International\\Geo" }, { "name": "Handle", "value": "0x000004e8" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo" } ], "repeated": 0, "id": 5633 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "Name" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name" } ], "repeated": 0, "id": 5634 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "AU" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name" } ], "repeated": 0, "id": 5635 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6af3a85b", "parentcaller": "0x6af3bb7f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5636 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x000004e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 5637 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 5638 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "\"Z4YNAWPMOlHJbvgX3eb6sgxxvBAjTfZLbRpNgdduL+o=\"" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 5639 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5640 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aebcc05", "parentcaller": "0x6aecee1a", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00004026", "pretty_value": "CSIDL_FLAG_DONT_VERIFY|CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 5641 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3" } ], "repeated": 0, "id": 5642 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 5643 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft" } ], "repeated": 0, "id": 5644 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate" } ], "repeated": 0, "id": 5645 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774aa06b", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000073c", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 5646 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774a87fe", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 5647 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5648 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "lang" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang" } ], "repeated": 0, "id": 5649 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "brand" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand" } ], "repeated": 0, "id": 5650 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "brand" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "INBX" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand" } ], "repeated": 0, "id": 5651 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "client" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client" } ], "repeated": 0, "id": 5652 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "iid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid" } ], "repeated": 0, "id": 5653 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5654 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004dc" }, { "name": "ValueName", "value": "experiment_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_labels" } ], "repeated": 0, "id": 5655 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aeecd3d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5656 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5657 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeeca9f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5658 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" } ], "repeated": 0, "id": 5659 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)" } ], "repeated": 0, "id": 5660 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "rrf@0.45" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)" } ], "repeated": 0, "id": 5661 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "hint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint" } ], "repeated": 0, "id": 5662 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint" } ], "repeated": 0, "id": 5663 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name" } ], "repeated": 0, "id": 5664 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name" } ], "repeated": 0, "id": 5665 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aee6e8b", "parentcaller": "0x6aee5cf1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5666 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e8" }, { "name": "ValueName", "value": "InstallTime" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779981955" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime" } ], "repeated": 0, "id": 5667 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5668 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "InstallTime" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1779981955" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime" } ], "repeated": 0, "id": 5669 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aee5eb5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5670 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aee5f69", "parentcaller": "0x6aee5d23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5671 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000004dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 5672 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004dc" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall" } ], "repeated": 0, "id": 5673 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aee613e", "parentcaller": "0x6aee5d3d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5674 }, { "timestamp": "2026-05-29 10:44:51,096", "thread_id": "10276", "caller": "0x6aee5d64", "parentcaller": "0x6af5dc9a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5675 }, { "timestamp": "2026-05-29 10:44:51,112", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x6f0b0000" } ], "repeated": 0, "id": 5676 }, { "timestamp": "2026-05-29 10:44:51,112", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\msxml6.dll" }, { "name": "BaseAddress", "value": "0x6f0b0000" } ], "repeated": 0, "id": 5677 }, { "timestamp": "2026-05-29 10:44:51,112", "thread_id": "10276", "caller": "0x6af3c1f1", "parentcaller": "0x6af5e6dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "88D96A05-F192-11D4-A65F-0040963251E5" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "2933BF81-7B36-11D2-B20E-00C04F983E60" }, { "name": "ProgID", "value": "Msxml2.DOMDocument.6.0" } ], "repeated": 0, "id": 5678 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f24d000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5679 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f24d000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5680 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5681 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "9" }, { "name": "FunctionAddress", "value": "0x7682e9e0" } ], "repeated": 0, "id": 5682 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5683 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e45000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5684 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e46000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5685 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e47000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5686 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e48000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5687 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e49000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5688 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e4b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5689 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e4d000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5690 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6f1238b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 5691 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6f1258f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 5692 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6f1238b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 5693 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af5eb54", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5694 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x000004d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 5695 }, { "timestamp": "2026-05-29 10:44:51,128", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aeca55e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "PersistedPingString" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "p\\x0cIs`\\x8e:\\xf3\\x03c\tN\\xf6\\x82uM\\x90ly\\x80G,\\xda\\xab\\xb6\\\\xfcD[\\x1f\\x05%I\\xccLV)Bv\\xa5*!\\x7f\\xeb\\xdc\\xa3\\x98\\xcb\\x9a\\xbe\\xe1K\\xdd\\x92;\\xe0k\\xce\\xc7\\xa40\\xd1\\xc3lM\\xf2\\x8f:d\\xb0\\xf9\\x9fN\\x91\\x86t\\x922\\x02\\x84\\xb9\\xfa\\xe3\\xcfdh\\xd8/\\x0f\\xa6\\x1f\\x8b?w\\x03Q8\\x07\\x8ck\\\\xb7u\\xf4\\x12&\\xf3\\x80\\x80\\x14\\xdfIC\\xf7<\\x86'\\x9f\\xe4\\xa9(9\\xfb\"\\x17N\\x0c\\xc2\\xc8(\\x80\\xa9\\x94\\x9f\\xf5]\\x86\\xb9\\x06\\xdd\\x06\\xad" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x060d11f0" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 6840 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x6cef5d74", "parentcaller": "0x70d03f73", "category": "crypto", "api": "BCryptImportKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyBlob", "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\x08\\xb0\\x0b\\xd1W\\xc2k2\\xe8%\\x0e\\xb1\\xe1N\\xc4\\x88\\xb3\\x94\\x1c\\xd7\\xc8\\xc5\\xa5\\xcdM\\xda\t\\xa3\\xc6\\x04A'\\x00\\x00\\x00\\x00\\x08\\xb0\\x0b\\xd1W\\xc2k2\\xe8%\\x0e\\xb1\\xe1N\\xc4\\x88\\xb3\\x94\\x1c\\xd7\\xc8\\xc5\\xa5\\xcdM\\xda\t\\xa3\\xc6\\x04A'\\xfb3\\xc7e\\xac\\xf1\\xacWD\\xd4\\xa2\\xe6\\xa5\\x9afn\\xb5,/H}\\xe9\\x8a\\x8503\\x83&\\xf67\\xc2\\x01c\\x16\\xbb'\\xcf\\xe7\\x17p\\x8b3\\xb5\\x96.\\xa9\\xd3\\xf8\\x84\\xffI\t\\xf9\\x16\\xc3\\x8c\\xc9%@\\xaa?\\x12\\x82\\xab\\xae\\x05\\xd9Ra\\xe2\\xce\"\\xea\\xd1{\\xb4\\xc4x\\xa8L\\x98C\\x8b aUH\\xac\\xa8p\\x08\\x06\\x97b\\x8a\\xad\\x0c{L\\xdam\\x99\\x82\\xf8\\x87H\\xf9LC0Q\\x00\\x82GZC\\xe3\\x12\\x12\\xefKb\\x1a\\xe9\\xdc\\x00\\x90D\\x7f\\x1bW\\\\x12\\x82\\xd5\\xa4\\x95\\xca,\\xe8\\xd6\\xfa}\\xe8tj\\xa5\\xd8\\x97x\\xb77\\xdc\\x1a\\xad\\xde\\x00\\x1a=\\x9a" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x060d1ee0" }, { "name": "Length", "value": "560" } ], "repeated": 0, "id": 6841 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6cfc3000" }, { "name": "ModuleName", "value": "schannel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6842 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6cfc3000" }, { "name": "ModuleName", "value": "schannel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6843 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b6118", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MSASN1" }, { "name": "DllBase", "value": "0x701b0000" } ], "repeated": 0, "id": 6844 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x0660\\x82\\x04\\x1e\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x02\\x80[\\xbe\\x96\\x97\\xa3^\\xa9\\x84\\x00\\x00\\x00\\x00\\x02\\x800\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x841\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1.0,\\x06\\x03U\\x04\\x03\\x13%Microsoft Update Secure Server CA 2.10\\x1e\\x17\r250828175321Z\\x17\r260828175321Z0n1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07R" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 6845 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x07\\x000\\x82\\x04\\xe8\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\n\\xb8\\x91\\xa2\\xc8\nP\\xa5\\xdf\\x00\\x00\\x00\\x00\\x00\n0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r120621173335Z\\x17\r270621174335Z0\\x81\\x841\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashingto" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 6846 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6847 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 6848 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006f8" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 6849 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "CryptDllFindOIDInfo" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo" } ], "repeated": 0, "id": 6850 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6851 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "1.3.6.1.4.1.311.64.1.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" } ], "repeated": 0, "id": 6852 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "KeyInformation", "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00N\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 6853 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 6854 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6855 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7" } ], "repeated": 0, "id": 6856 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name" } ], "repeated": 0, "id": 6857 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b2972", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 6858 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29b2", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 6859 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29e0", "parentcaller": "0x774b25fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6860 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xe3\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0b\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00:\\x03\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x00\\x00\\x00:\\x03\\x00\\xafx\\x03" } ], "repeated": 0, "id": 6861 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x774aee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6862 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x774b204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x0000070c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" } ], "repeated": 0, "id": 6863 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x774b204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6864 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ac899", "parentcaller": "0x774b26ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dnsapi.dll" } ], "repeated": 0, "id": 6865 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774af01c", "parentcaller": "0x774b1ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Domain Name System (DNS) Server Trust" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103" } ], "repeated": 0, "id": 6866 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b26df", "parentcaller": "0x774b3069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6867 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name" } ], "repeated": 0, "id": 6868 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b2972", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 6869 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29b2", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 6870 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29e0", "parentcaller": "0x774b25fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6871 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xe3\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00:\\x03\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0b\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00:\\x03\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x00\\x00\\x00:\\x03\\x08\\xb6x\\x03" } ], "repeated": 0, "id": 6872 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x774aee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6873 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x774b204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000710" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" } ], "repeated": 0, "id": 6874 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x774b204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6875 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ac899", "parentcaller": "0x774b26ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dnsapi.dll" } ], "repeated": 0, "id": 6876 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774af01c", "parentcaller": "0x774b1ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Domain Name System (DNS) Server Trust" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103" } ], "repeated": 0, "id": 6877 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b26df", "parentcaller": "0x774b3069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6878 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000708" } ], "repeated": 0, "id": 6879 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" } ], "repeated": 0, "id": 6880 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 6881 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "1.3.6.1.4.1.311.80.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" } ], "repeated": 0, "id": 6882 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "KeyInformation", "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff84\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 6883 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774efd73", "parentcaller": "0x7749d052", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 6884 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6885 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7" } ], "repeated": 0, "id": 6886 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name" } ], "repeated": 0, "id": 6887 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b2972", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 6888 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29b2", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 6889 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29e0", "parentcaller": "0x774b25fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6890 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xe3\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00:\\x03\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0b\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00:\\x03\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x00\\x00\\x00:\\x03p\\xb7x\\x03" } ], "repeated": 0, "id": 6891 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x774aee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6892 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x774b204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x0000070c" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" } ], "repeated": 0, "id": 6893 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x774b204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6894 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ac899", "parentcaller": "0x774b26ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 6895 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774af01c", "parentcaller": "0x774b1ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Document Encryption" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } ], "repeated": 0, "id": 6896 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b26df", "parentcaller": "0x774b3069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6897 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "ValueName", "value": "Name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name" } ], "repeated": 0, "id": 6898 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b2972", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings" } ], "repeated": 0, "id": 6899 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29b2", "parentcaller": "0x774b25fa", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "ValueName", "value": "StringCacheGeneration" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration" } ], "repeated": 0, "id": 6900 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b29e0", "parentcaller": "0x774b25fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6901 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xe3\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00:\\x03\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0b\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00:\\x03\\xb0\\xe1\\xfa\\x00\\xff\\x07\\x00\\x00\\x00\\x00:\\x03\\x00\\xafx\\x03" } ], "repeated": 0, "id": 6902 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x774aee2f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 6903 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x774b204b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000710" }, { "name": "ObjectAttributesName", "value": "Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E" } ], "repeated": 0, "id": 6904 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x774b204b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000710" } ], "repeated": 0, "id": 6905 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ac899", "parentcaller": "0x774b26ef", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" } ], "repeated": 0, "id": 6906 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774af01c", "parentcaller": "0x774b1ef7", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "ValueName", "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Document Encryption" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124" } ], "repeated": 0, "id": 6907 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774b26df", "parentcaller": "0x774b3069", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000070c" } ], "repeated": 0, "id": 6908 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000708" } ], "repeated": 0, "id": 6909 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b151c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000704" } ], "repeated": 0, "id": 6910 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 6911 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b15b2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6912 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 6913 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006f8" } ], "repeated": 0, "id": 6914 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6915 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters" } ], "repeated": 0, "id": 6916 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749e6db", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006f8" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 6917 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006f8" } ], "repeated": 0, "id": 6918 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6919 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6920 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777f1f80", "parentcaller": "0x777d8db8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 6921 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6922 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777d931b", "parentcaller": "0x777d9782", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006f8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 6923 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777d97cc", "parentcaller": "0x777d92ae", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000006f8" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\crypt32.dll.mui" } ], "repeated": 0, "id": 6924 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777d97f4", "parentcaller": "0x777d92ae", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x061d0000" }, { "name": "SectionOffset", "value": "0x060be2a8" }, { "name": "ViewSize", "value": "0x0000a000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6925 }, { "timestamp": "2026-05-29 10:44:52,284", "thread_id": "10416", "caller": "0x777d9804", "parentcaller": "0x777d92ae", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 6926 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6927 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6928 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6929 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x764109b0", "parentcaller": "0x76410ab4", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001f8" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00m\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6930 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774b1b7a", "parentcaller": "0x764112a6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "ModuleHandle", "value": "0x75df0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e05880" } ], "repeated": 0, "id": 6931 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x0660\\x82\\x04\\x1e\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x02\\x80[\\xbe\\x96\\x97\\xa3^\\xa9\\x84\\x00\\x00\\x00\\x00\\x02\\x800\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x841\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1.0,\\x06\\x03U\\x04\\x03\\x13%Microsoft Update Secure Server CA 2.10\\x1e\\x17\r250828175321Z\\x17\r260828175321Z0n1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07R" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 6932 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b6118", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x07\\x000\\x82\\x04\\xe8\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\n\\xb8\\x91\\xa2\\xc8\nP\\xa5\\xdf\\x00\\x00\\x00\\x00\\x00\n0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r120621173335Z\\x17\r270621174335Z0\\x81\\x841\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashingto" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 6933 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aa2e000" }, { "name": "ModuleName", "value": "webio.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6934 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aa2e000" }, { "name": "ModuleName", "value": "webio.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6935 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a9e76", "parentcaller": "0x760a85fb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6936 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x760a8618", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 6937 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6938 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 6939 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "DisableSerialChain" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain" } ], "repeated": 0, "id": 6940 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a492e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 6941 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760a8798", "parentcaller": "0x760a8278", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6942 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6943 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 6944 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "CryptnetPreFetchTriggerPeriodSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds" } ], "repeated": 0, "id": 6945 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "MaxUrlRetrievalByteCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount" } ], "repeated": 0, "id": 6946 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6947 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 6948 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "DisallowedCertSyncDeltaTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime" } ], "repeated": 0, "id": 6949 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6950 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6951 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores" } ], "repeated": 0, "id": 6952 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6953 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6954 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760ba507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6955 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6956 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" } ], "repeated": 0, "id": 6957 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760ceaa3", "parentcaller": "0x760baaeb", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "103" } ], "repeated": 1, "id": 6958 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6959 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6960 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000704" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\" } ], "repeated": 0, "id": 6961 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6962 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6963 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6964 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000708" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\" } ], "repeated": 0, "id": 6965 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6966 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6967 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores" } ], "repeated": 0, "id": 6968 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6969 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6970 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760ba507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6971 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6972 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6973 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000070c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\" } ], "repeated": 0, "id": 6974 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6975 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6976 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6977 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6978 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6979 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot" } ], "repeated": 0, "id": 6980 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6981 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6982 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores" } ], "repeated": 0, "id": 6983 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6984 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6985 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760ba507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6986 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6987 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6988 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d7000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6989 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000710" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\" } ], "repeated": 0, "id": 6990 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6991 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6992 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores" } ], "repeated": 0, "id": 6993 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6994 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6995 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760ba507", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 6996 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 6997 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 6998 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000714" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\" } ], "repeated": 0, "id": 6999 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760bb7f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7000 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "AutoFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags" } ], "repeated": 0, "id": 7001 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d9000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7002 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "DisableAutoFlushProcessNameList" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList" } ], "repeated": 0, "id": 7003 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "AutoFlushFirstDeltaSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds" } ], "repeated": 0, "id": 7004 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "AutoFlushNextDeltaSeconds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds" } ], "repeated": 0, "id": 7005 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8bcc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7006 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000704" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 7007 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7008 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7009 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7010 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000708" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates" } ], "repeated": 0, "id": 7011 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7012 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7013 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7014 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7015 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7016 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 7017 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7018 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7019 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7020 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7021 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000070c" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates" } ], "repeated": 0, "id": 7022 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7023 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7024 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7025 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000710" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 7026 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7027 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7028 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7029 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7030 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x0003001f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7031 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 7032 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7033 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7034 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7035 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7036 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000714" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates" } ], "repeated": 0, "id": 7037 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7038 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2" } ], "repeated": 0, "id": 7039 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7040 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000704" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates" } ], "repeated": 0, "id": 7041 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "ValueName", "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE" } ], "repeated": 0, "id": 7042 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE" } ], "repeated": 0, "id": 7043 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "Blob" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob" } ], "repeated": 1, "id": 7044 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eecbb", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "Blob" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00'\\x9c\\xd6R\\xc4\\xe2R\\xbf\\xbeR\\x17\\xacr\"\\x05\\xd7r\\x9b\\xa4\t\\x14\\x8c\\xfa\\x9em\\x9e[\\x1c\\xb9N\\xaf\\xf1\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00T\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00C\\x00e\\x00r\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00e\\x00 \\x00A\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00 \\x002\\x000\\x001\\x001\\x00\\x00\\x00i\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0e\\x00\\x00\\x000\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x03\\x02\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x8fC(\\x8a\\xd2r\\xf3\\x10;o\\xb1B\\x84\\x85\\xea0\\x14\\xc0\\xbc\\xfe\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00r-:\\x021\\x90C\\xb9\\x14\\x05N\\xe1\\xea\\xa7\\xc71\\xd1#\\x894\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\x04\\x90\\xd5\\xe5l4\\xa5\\xae\\x0b\\xe9\\x8b\\xe5\\x81\\x18] \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf1\\x05\\x00\\x000\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob" } ], "repeated": 0, "id": 7045 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b2a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7046 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7047 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760b71d3", "parentcaller": "0x760b69bd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220528Z\\x17\r360322221304Z0\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x10" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7048 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7049 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 7050 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 7051 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 7052 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 7053 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7054 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 7055 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "EncodingType 1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1" } ], "repeated": 0, "id": 7056 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000700" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 7057 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7058 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 7059 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760b13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7060 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760a9148", "parentcaller": "0x760a90fd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0Q\\x82\\x15api.cdp.microsoft.com\\x82\\x17*.api.cdp.microsoft.com\\x82\\x1f*.backend.api.cdp.microsoft.com" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7061 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xeb\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf0\\xf4x\\x03\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xeb\\x01\\x00\\x01*\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\xec\\x0b\\x06\\x00\\x00\\x00\\x00*\\x00\\x00\\x00H\\x00\\x00\\x00L\\x03:\\x03" } ], "repeated": 0, "id": 7062 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000006fc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7063 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000006fc" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 7064 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006fc" } ], "repeated": 0, "id": 7065 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 7066 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000700" } ], "repeated": 0, "id": 7067 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7068 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 7069 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7782fcba", "parentcaller": "0x777d22b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000718" } ], "repeated": 0, "id": 7070 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7071 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 7072 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7073 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" } ], "repeated": 0, "id": 7074 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7075 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 7076 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7077 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000718" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 7078 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7782fcba", "parentcaller": "0x777d22b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7079 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "PinRulesLogDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir" } ], "repeated": 0, "id": 7080 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000700" }, { "name": "ValueName", "value": "PinRules" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules" } ], "repeated": 0, "id": 7081 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7082 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 7083 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "ValueName", "value": "PinRulesLastSyncTime" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x18\\xedv\\x16X\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime" } ], "repeated": 0, "id": 7084 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760a80d7", "parentcaller": "0x760a8043", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7085 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7086 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a9e76", "parentcaller": "0x760a8665", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7087 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x760a867d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7088 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a9e76", "parentcaller": "0x760c89b9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xed\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00VH~wB\\x10\\x00\\x00zP~w\\xda\\xab\\xce\\xbc\\xd8?;\\x03\\x00\\x00:\\x03\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x00\\x90\\xed\\x0b\\x06\\xc7\\xf1|w\\xff\\x07\\x00\\x00\\x00\\x00:\\x03\\x00\\x00:\\x03A\\x10\\x00\\x00\\x03\\xaa\\x08\\xa1\\x08\\xea;\\x03\\x08\\x82\\x00\\x00\\x01\\x02\t\n\\xff\\x07\\x00\\x00\\xd0/<\\x03\\x00\\x00:\\x03\n\\x00\\x00\\x00\\xc8/:\\x03\\xe4\\x01\\x00\\x01\\xc0\\x0f\\x00\\x00\\xc8/:\\x03\\xff\\x07\\x00\\x00\\x01\\x00\\x00\\x00\\xec-\\x81wL\\xee\\x0b\\x06\\xf9\\xa8\\xb9j\\x88\\xf0\\x0b\\x06L\\xee\\x0b\\x06P\\xee\\x0b\\x06\\x00\\x00:\\x03\\x00PU\\x02\\xfc\\xed\\x0b\\x06j(\\xc4j\\xec-\\x81w\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x88\\xf0\\x0b\\x06L\\xee\\x0b\\x06\\xfc\\xed\\x0b\\x06\\xe8\\xed\\x0b\\x06P\\xee\\x0b\\x06\\x00\\x00\\x00\\x00\\xec-\\x81w\\x00\\x00\\x00\\x00\\x97\\xaaJw\\xfe\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00,\\xee\\x0b\\x060\\xee\\x0b\\x06" } ], "repeated": 0, "id": 7089 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x760c870c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7090 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7091 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000308" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7092 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000724" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 7093 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a81e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7094 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 7095 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 7096 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 7097 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060dc000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7098 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 7099 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060e1000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7100 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774eecbb", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000724" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 7101 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760b75fe", "parentcaller": "0x760c0615", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x800\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x00\\x00\\x00" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 7102 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760b75fe", "parentcaller": "0x760c07c2", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x07\\xb80\\x82\\x07\\x95\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03!\\x01\\x01\\xff\\x04\\x82\\x07\\x820\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 7103 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000724" } ], "repeated": 0, "id": 7104 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c3ca9", "parentcaller": "0x760a3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7105 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7106 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7107 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7108 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7109 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7110 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7111 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7112 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7113 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7114 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7115 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7116 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7117 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7118 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7119 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7120 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7121 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xb1\\x02\\x01\\x00\\x02\\x01\\x010\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7122 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7123 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7124 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7125 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7126 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7127 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7128 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7129 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7130 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7131 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7132 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x08\\x02\\x01\\x00\\x02\\x01\\x010\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7133 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7134 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7135 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7136 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7137 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7138 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7139 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7140 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7141 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7142 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7143 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7144 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7145 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7146 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7147 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7148 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7149 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7150 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c3d6d", "parentcaller": "0x760a3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "\\x17\r180601232859Z" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 7151 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760c3ac2", "parentcaller": "0x760abd4a", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 7152 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x760aa2a6", "parentcaller": "0x760a9622", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7153 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060e6000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7154 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060f7000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7155 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6a9f46bc", "parentcaller": "0x6a9f463b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7156 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06108000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7157 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6cef6758", "parentcaller": "0x6cef6465", "category": "crypto", "api": "BCryptEncrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Input", "value": "'\\x10\\xc5P\\x0cG\\xd1\\x14\\xf0'\\x0e\\x1b\\xf6]\\xcev\\xf5\\xb6\\xca?\\xe1\\xa7\\xe8\\x16\\x12e\\x18\\x8dH$\\xf9\\x15\\x84\\xf8\\xb5\\xe0/h\\x92\\x1c\\xce\\xf5\\x8e\\x03\\x82\\xbc9\\xe0\\xdb\\xd9\\x11\\x91\\xbej\\xca*\\\\x84" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x060d1ee0" }, { "name": "Length", "value": "58" } ], "repeated": 0, "id": 7158 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6a9eb419", "parentcaller": "0x6a9eae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1648" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00R\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01'\\x10\\xc5P\\x0cG\\xd1\\x14\\xf0'\\x0e\\x1b\\xf6]\\xcev\\xf5\\xb6\\xca?\\xe1\\xa7\\xe8\\x16\\x12e\\x18\\x8dH$\\xf9\\x15\\x84\\xf8\\xb5\\xe0/h\\x92\\x1c\\xce\\xf5\\x8e\\x03\\x82\\xbc9\\xe0\\xdb\\xd9\\x11\\x91\\xbej\\xca*\\\\x84/#FX8\\x9c\\x95\\xc2\\xe90N.>\\xcf\\xbai" } ], "repeated": 0, "id": 7159 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6a9eb72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000740" } ], "repeated": 0, "id": 7160 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6cef6758", "parentcaller": "0x6cef6465", "category": "crypto", "api": "BCryptEncrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Input", "value": "~\\xb2VI\\x0f\\xa1\\xe4\\xa9\\xfan/7\\xba\n\\xcf\\x8d\\x85s\\xb2}8\\xfe\\xb7\\x9b\\xe5\t\\xda2\\x02\\xc7\\x0f\\xdbU\\xb9^\\xe0azB\\xa5D\\xbf\\xc0\\x9a\\xe1MB\\x13AIF\\xbcNB\\x87ovn\\\\xc6\\x15\\x00f\\xcbX~\\x95\\xa2\\xf2J\\xb5'\\xafy\\x05\\xe2\\xd7\\xbdz\\x0fv\\xef\\xda\\x17\n\\xca<${>\\x92\\xb4. \\xadqu\\x11\\x1bg\\xd1\\xde\\xddGI'|\\x7f(.\\xaaHj\\x81\\xf8[\\x82e\\x82\\xae\\xecn\\xdd>7>\\x7f\\xe5jW\\xb0ae\\xa1\\xdaxK\\x15A7\\xd4\\xccH\\xd6)\\xcaz`C\\xe6t-\\xb9\\xb7\\xe5l\\xa7R-|\\xf6\\xf5\\x89|d\\x84\\x88\\xed0\\xbf\\x81{\\xfe]lv'B\\xd6\\x98\\xd7\\x7f\\x82\\xfc\\xd8\\xed8\\xfd\\x9e\\xa2\\x02\\xfe\\x1f\\x18<\\x8fR\\x0e\\x17\\x03.\\xb3\\xb4\\xef,@\\xcc\\xdd\\xfc\\xad4g\\xfd\\xd6Z\\xdc\\xed\\xdb{\\xfa\\xf9\\xfd\\xd3\\\\x12W\\x80\\x01\\xdf!5\\x0e\\xba\\xf5\\xf6\\xb6\\x87\\xf8\\x87\\xb0\\xd5\\xe8\\xcb\\xadU\\x19d\\x14K\\x1b\\xbf\\xbe\\x1f-<\\xfc" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x060d1ee0" }, { "name": "Length", "value": "386" } ], "repeated": 0, "id": 7161 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10484", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7162 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10484", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 7163 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6a9eb419", "parentcaller": "0x6a9eae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1648" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x01\\x9a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02~\\xb2VI\\x0f\\xa1\\xe4\\xa9\\xfan/7\\xba\n\\xcf\\x8d\\x85s\\xb2}8\\xfe\\xb7\\x9b\\xe5\t\\xda2\\x02\\xc7\\x0f\\xdbU\\xb9^\\xe0azB\\xa5D\\xbf\\xc0\\x9a\\xe1MB\\x13AIF\\xbcNB\\x87ovn\\\\xc6\\x15\\x00f\\xcbX~\\x95\\xa2\\xf2J\\xb5'\\xafy\\x05\\xe2\\xd7\\xbdz\\x0fv\\xef\\xda\\x17\n\\xca<${>\\x92\\xb4. \\xadqu\\x11\\x1bg\\xd1\\xde\\xddGI'|\\x7f(.\\xaaHj\\x81\\xf8[\\x82e\\x82\\xae\\xecn\\xdd>7>\\x7f\\xe5jW\\xb0ae\\xa1\\xdaxK\\x15A7\\xd4\\xccH\\xd6)\\xcaz`C\\xe6t-\\xb9\\xb7\\xe5l\\xa7R-|\\xf6\\xf5\\x89|d\\x84\\x88\\xed0\\xbf\\x81{\\xfe]lv'B\\xd6\\x98\\xd7\\x7f\\x82\\xfc\\xd8\\xed8\\xfd\\x9e\\xa2\\x02\\xfe\\x1f\\x18<\\x8fR\\x0e\\x17\\x03.\\xb3\\xb4\\xef,@\\xcc\\xdd\\xfc\\xad4g\\xfd\\xd6Z\\xdc\\xed\\xdb{\\xfa\\xf9\\xfd\\xd3\\\\x12W\\x80\\x01\\xdf!5\\x0e\\xba\\xf5\\xf6\\xb6\\x87\\xf8\\x87\\xb0\\xd5\\xe8\\xcb\\xadU\\x19d\\x14K\\x1b\\xbf\\xbe\\x1f-<\\xfc,\\xa4~o\\x0c+\\xde~\\x00$\\xda\\xe3J\\xf5\\x9cs\\xe2\\x0b\\xfaW\\xd4\\x8fh\\xe1\\x1c\\xeb\\xe2\\x84\\x03h\\x14m[\\xb1\\xe8\\xc56\\xe1`\\xf3\\x809@R\\xbe8b3\\x8d\n\\xf9pBY6\\xfb\\xd34\\xf7A\\x90\\xbfL\\x8e\\x90\\x19\\x937\\xd5\\xf7\\xdf\\x91\\x92\\x8fm\\xaf,q\\xac\\x08+1\\xc1L\\x1e\\x1dm\\xfd\\xeb\\xce\\x8f\\xe6BW\\x13d\\xb5\\xfd\\xbe\\xee\\xf7\\xdbF\\xce\\xbc\\x11\\x16[\\xdd-k\\xa7\\x95\\xc4p\\x87\\xc8\\xca\\xae\\xa8\\x96\\xdb8\\x06\\xb4\\xd6\\x85\\xca\\xdc2\\xbbI$\\x9d\\xae\\x93Y\\x97l\\x9e\\xc32d\\x1a\\x8c-" } ], "repeated": 0, "id": 7164 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6a9eb72c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000740" } ], "repeated": 0, "id": 7165 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6a9ea694", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7166 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x6a9ece77", "parentcaller": "0x6a9ec83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1648" } ], "repeated": 0, "id": 7167 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6a9ee87f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d0" } ], "repeated": 0, "id": 7168 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10484", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0610c000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7169 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10484", "caller": "0x6cef6758", "parentcaller": "0x6cef6465", "category": "crypto", "api": "BCryptEncrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Input", "value": "\\xdb\\x15\\x17\\xf4\\xff1l\\x1e\\xd2\\xfb\\xbc\\xc2_J\\xd8q\\x85\\xce\\xee\\xc87\t\\x9c\\xaa\\xd5\\x8c\\xb3H\\x9dG\\xf6\\xf63\n\\x92\\x99H\\xa8\\x1d\\x0b\\xa1\\xf5k\\x83\\x9f.\\x03\\xa8\\xfe\"\\xe1\\xae\\x8d\\x872yY\\xca&\\xeb\\xcb\\xf9\\x98n\\xbbXY\\xe9^\\xe5\\xa6\\xe1\\x01e@\\x08J0(]\\x94\\xec0\\xd4h3\\xa6.\\x11\\xb7\\x7f\\x8f\\x87{\\x0c\\xc9\\xd3\\xac\\xfb\\xdd\\xd6\\xbd\\xd2\\xbd\\x1a\\x942\\xca\\xc3\\xd5A\\xa6C\\x8c\\x85\\xff\\x08\\xcc\\xed{\\x85bW\\xees\\xca\\x04r\\\\xd9\\xe75V\\xc6uZ\\xb6\\x7f\\x9f\\xf0\\xaf\\x91\\xd0\"\\xdc\\x7f\\xd3z\\xe2\\x05\\xac\\x9a'\\x93\\xe8\\xb7\\xd6\\x85^*S7\\x96d\\x13\"\\x96\\xf8\\x8d\\xb8\\xe3\\xdbgG\\x14V\\xd6kJuv\\xb7F\\xdb\\x13\\xae\\xd1\\xc5\\xc4\\x07\\xf9\\x91\\xee[\\xad\\xef*O\\xa2\\x0bV\\xdf\\xceV\\xae%\\xe4\\xf5\\xbb\\x99\\xef\\x8d\\xdc\\x85*\\xc0J\\xd59\\x1aK\\xbb\\xce\\x02z3H\\xf26\\xf2\\x05|=\\xc3+\rM\\xfa\\xd6\\xf1\\x01%\\x8b\\xb0\\xb2\\xa33@\\x0c\\xc7G3.*\\xa7\\xe3" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x060d1ee0" }, { "name": "Length", "value": "2615" } ], "repeated": 0, "id": 7170 }, { "timestamp": "2026-05-29 10:44:52,299", "thread_id": "10484", "caller": "0x6a9eb419", "parentcaller": "0x6a9eae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1648" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\nO\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\xdb\\x15\\x17\\xf4\\xff1l\\x1e\\xd2\\xfb\\xbc\\xc2_J\\xd8q\\x85\\xce\\xee\\xc87\t\\x9c\\xaa\\xd5\\x8c\\xb3H\\x9dG\\xf6\\xf63\n\\x92\\x99H\\xa8\\x1d\\x0b\\xa1\\xf5k\\x83\\x9f.\\x03\\xa8\\xfe\"\\xe1\\xae\\x8d\\x872yY\\xca&\\xeb\\xcb\\xf9\\x98n\\xbbXY\\xe9^\\xe5\\xa6\\xe1\\x01e@\\x08J0(]\\x94\\xec0\\xd4h3\\xa6.\\x11\\xb7\\x7f\\x8f\\x87{\\x0c\\xc9\\xd3\\xac\\xfb\\xdd\\xd6\\xbd\\xd2\\xbd\\x1a\\x942\\xca\\xc3\\xd5A\\xa6C\\x8c\\x85\\xff\\x08\\xcc\\xed{\\x85bW\\xees\\xca\\x04r\\\\xd9\\xe75V\\xc6uZ\\xb6\\x7f\\x9f\\xf0\\xaf\\x91\\xd0\"\\xdc\\x7f\\xd3z\\xe2\\x05\\xac\\x9a'\\x93\\xe8\\xb7\\xd6\\x85^*S7\\x96d\\x13\"\\x96\\xf8\\x8d\\xb8\\xe3\\xdbgG\\x14V\\xd6kJuv\\xb7F\\xdb\\x13\\xae\\xd1\\xc5\\xc4\\x07\\xf9\\x91\\xee[\\xad\\xef*O\\xa2\\x0bV\\xdf\\xceV\\xae%\\xe4\\xf5\\xbb\\x99\\xef\\x8d\\xdc\\x85*\\xc0J\\xd59\\x1aK\\xbb\\xce\\x02z3H\\xf26\\xf2\\x05|=\\xc3+\rM\\xfa\\xd6\\xf1\\x01%\\x8b\\xb0\\xb2\\xa33@\\x0c\\xc7G3.*\\xa7\\xe3\\xa5~;E\\xc0\n&\\x0e0\\x08~\\xb4T\\xb5\\xf5wc\\xdcM\\xf5Ca\\xccvy\\xe1\\x15\\x92Z\\x1f\\xc2\\xdb<\\x00K\\xcd\\x1f\\x1d<\\x93=*\\xf9\\xc9\\xa9\\x91;x\\xde\\xbcH\\xbc\\xc5\\x97\\xa08=\\xeb|\\x87\\xb8\\x01,u\\xd2\\xf6+\\x90\\xce\\x94\\x1c\\xab\\x1e\\xd9X)\\x83\\x10\\xbc\\x8a\\xc5u\\xd3FI\tR\\x91VP\\xacq\\x14z\\x99\\x1bi\\xbfM\\xf4yA\\xcb0\\xe6+\\xb0X\\x1a\\xb3\\xcb\\xc4\\x8d\\x7fM\\xa3\\xca\\x08\\xa6\\x02V\\xd0_\\x08\\xf7XQ&\\x12\\xcfS\\xc8\\xc4N\\\\xc1;i\\x8cC\\x01@\\xfa\\x02\\xce\\x03E,\\x14\\xcdz\\xd7\\x8e\\xb2\\x908k%^]\\xa8\\xc1H\\xb7\\x99|o\\x06\\xfb\\xb04\\xca\\x1c\\xb0\\xd5V\\xa6\\xfb\\x94|\\xad\\xc9q\\xbc\\xf0f\\xc3\\xb5=C\\xef,\\xad\\xa4\\xd7\\xe3\\xea>78\\xaa\\xfd^\n\\xa0\\x89\\xec\\xd9\\xce\\x11\\x85?\\xfdx3\\xf1\\xb1&\\x12\\x16h\\xf6B<<]'\\xd5\\x85\\xbd\\xbb\\xa3\\xd8\\x1d\\xd2g\\x94\\xfe\tg\"\\x03F\\x84\\xd1vtp\\x87>\\x12l\"\\x95\\xd5\\xb8W\\x90\\xaa\\xb2Y\\xe7_\\xfa\\x8c\\xef\\xbd\\xf22\\xdf\\xb9X\\xf7U\\xe1\\xfa41\\xc2\\xe5 \\xd3\\x02\\xc9\\xa9\\xda\\xca\\xa1Z\\x92G\\xb9O wg2\\xb3\\xfbk#\\xa4\\xd6\\xea\\xaba\\xbb=\\x01x\\x03\\xdcz\\xf4\\xeeE\\x8e\\x851\\xdd^\\x04\\xb9\\xc7U\\x0c\\xd1\\x82\\xa4AI\\x9fy\\xe81\\x93\\x1e\\xf3\\x93\\xfdK\\x87qm\\x10\\x91_5\\xdc)h@ja\\xe3\\xbe\\x87\\x9c\\x83r+\\xa9\\x93\\xac\\xf1\\x93\\xf4\\xf98\\xe8\\xd9~f\\x92W{9\\xa3N\\xf4\\xd0\\xdaH\\x89\\xb4z\\x01\\x89\\x19\\xa9\\xf1?a\\xa0\\x87W\\xf2\\xa5\\xf3\\xd4\\xf39\\x88]\\xf2\\x1fqp\\x1d!f7\\x03\\x9a\\xb5\\x14\\xbc\\xd5\\xe1\\xfb\\x98*`\\xc7\\x07x\\x02xdj\\xa6'\\xa9\\x8a4<]\\xdaJ\\xc6+\\xd8<4\\x01A\\xb0i\\xa2uL\\xb9\\xe0\\x1e\\x9ac15\\xba\r1\\x94\\xb4D\\xcd\\x1ao\\xcb\\x00\\xe2m\\x15\\xac\\xb0v\\xbd\\xd7\\xb3\\xef\\xfdw\\xec\\xc94\\x8e\\xb5\\x14%k\\xa7\\xec\\xb0\\xaf'\\x1f\\x14\\x94\\xa1\\xf7\\xda\\x17\\xf4\\x11\"ToWB\\x1b,\\xf7\\xfa\\xe3\\xbe8\\x17\\x0e9,,\\xac\\x8a2K$\\xe1\\x80I\\xf1\\xe7\\x11=%\\xdf~\\xcbH:zW\\xb3\\xde\\x81\\x8f\\x91\\x81\\x874\\x0bM$FS\\x96\\xea\\xbc\\x9fP\\xd4\\x92\\x85\\x90z0\\xa8\\xd5U\\xeb\\xb5{\\xc7\\xe1\\xed\\xbd\\xa4.ew\\xde\\x13\\xbfC~\\xcc\\xb9\\xac\\x17cY\\x0fK\\xe4\\xf2\\x11\\x8a\\xd3\\xa2\\x7f\\x93\\xb9\\xa1\\xf4Y\\xe3\\xb2D\\xcd0?o\\xa6\\xec\\x81\\xbe\\x8a\\xcb\\x93?K\\x89\\xb0)Y\\x8b]\\xe9P\\xb9\\xae\\x156\\xc28\\x08\\xb0\\xca\\xa9]\\x10\\xae\\xde\\xc3\\x80\\xae\\xfa\\xef!%\\x1f\\xbf\t^\\xa7\\x07*\\x82^P<\\xd1\\xd6v6\\x96\\xda\\xb2&\\xd9X\\xb1E\\x97*\\xda\\xd7\\xfe\\x89\\xb8\\xd7;\\xc7z*\\x13]\\xe8\\xb9\\x8c=\\xbaBMc\\x99\\xaa\\xf1\\xd2L/5\\xbe\\xf2\\x12\\x13\\xc8\"\\xc4\\xf97\\xce\\xb6\\xde\\xcc_\\x10M\\x95L\\x12\\xcc\\xac\\xadF1\\xba\\xee')\\xc7s8\\x96y\\x0eh\\xde\\xe3\n\\x18\\x95\\x02\\xe7\\x9dg4g\\x18\\xe8rC\\xf1*\\x02\\xeaYG\\xa0m\\x1b?\\xa8u\\x13\\xbf\\x99\\xffj6V\\x92\\xe6l\\x19\\x87\\xb3\\x92=C3\\xb9\\xf8.\\xec\t\\xe1\\xb7\\x05\n\n5\\xf6\\xe3\\x17\\xc3\\x14\\x0f\\x0ec\\xd4A\\x97\\xfaR\\x9c\\xed\\xe8\\xe6\\xf0\\xcd\\xbb\\xa5};\\x9fI\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7391 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`>\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7392 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00`>\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7393 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`>\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7394 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 7395 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7396 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ConsecutiveCheckFailures" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ConsecutiveCheckFailures" } ], "repeated": 0, "id": 7397 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6aed2473", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7398 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af10c62", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7399 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 7400 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 7401 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7402 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 7403 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7404 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7405 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 7406 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7407 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7408 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 7409 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7410 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7411 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7412 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7413 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 1, "id": 7414 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "ValueName", "value": "dr" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 0, "id": 7415 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af1d849", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" }, { "name": "ValueName", "value": "dr" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "0" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 0, "id": 7416 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d86e", "parentcaller": "0x6af1d2bf", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7417 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7418 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 7419 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7420 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7421 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7422 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7423 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7424 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7425 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecaf8a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000748" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7426 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aecaf99", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000748" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr" } ], "repeated": 0, "id": 7427 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecafa9", "parentcaller": "0x6af1d71c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000748" } ], "repeated": 0, "id": 7428 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d7ab", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7429 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d3f2", "parentcaller": "0x6af076df", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7430 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af07463", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7431 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7432 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7433 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7434 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af074d9", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ActivePingDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780012800" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec" } ], "repeated": 0, "id": 7435 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af07501", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780012800" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec" } ], "repeated": 0, "id": 7436 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af07538", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfLastActivity" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "7088" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity" } ], "repeated": 0, "id": 7437 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af0755e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "7088" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall" } ], "repeated": 0, "id": 7438 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af07590", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{9100CF4A-F6D7-467F-8F5F-D6AEC56BE654}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness" } ], "repeated": 0, "id": 7439 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af075b1", "parentcaller": "0x6af076ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7440 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7441 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7442 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7443 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7444 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfInstall" } ], "repeated": 0, "id": 7445 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af0766f", "parentcaller": "0x6af0770a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7446 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 1, "id": 7447 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7448 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7449 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7450 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6af06c26", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken" } ], "repeated": 0, "id": 7451 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06c6b", "parentcaller": "0x6af065a8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7452 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7453 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7454 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f13", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "rrf@0.99" }, { "name": "BufferLength", "value": "18" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)" } ], "repeated": 0, "id": 7455 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f2b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint" } ], "repeated": 0, "id": 7456 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f3d", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 7457 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee6f57", "parentcaller": "0x6af065db", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7458 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7459 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7460 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7461 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7462 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af06d41", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LatestRecommendedVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LatestRecommendedVersion" } ], "repeated": 0, "id": 7463 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06d58", "parentcaller": "0x6af065ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7464 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7465 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7466 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee5972", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7467 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee597f", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7468 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee5992", "parentcaller": "0x6af06660", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7469 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aee58f4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7470 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7471 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastCheckSuccess" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780051492" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LastCheckSuccess" } ], "repeated": 0, "id": 7472 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6aee591e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7473 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7474 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af10c62", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7475 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 7476 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 7477 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7478 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 7479 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7480 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7481 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 7482 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7483 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7484 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 7485 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7486 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7487 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7488 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7489 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7490 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 7491 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7492 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7493 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7494 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7495 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7496 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7497 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\dr" } ], "repeated": 0, "id": 7498 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d7ab", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7499 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d3f2", "parentcaller": "0x6af076df", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7500 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af07463", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7501 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7502 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7503 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7504 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af07501", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780012800" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec" } ], "repeated": 0, "id": 7505 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af0755e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "7088" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall" } ], "repeated": 0, "id": 7506 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af07590", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{503CFA57-C3B9-4F99-873B-9DBA2BDA84CB}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness" } ], "repeated": 0, "id": 7507 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af075b1", "parentcaller": "0x6af076ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7508 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7509 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7510 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7511 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7512 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "7087" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfInstall" } ], "repeated": 0, "id": 7513 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af0766f", "parentcaller": "0x6af0770a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7514 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 1, "id": 7515 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7516 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7517 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7518 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6af06c26", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken" } ], "repeated": 0, "id": 7519 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06c6b", "parentcaller": "0x6af065a8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7520 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7521 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7522 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f13", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "rrf@0.53" }, { "name": "BufferLength", "value": "18" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)" } ], "repeated": 0, "id": 7523 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f2b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint" } ], "repeated": 0, "id": 7524 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f3d", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name" } ], "repeated": 0, "id": 7525 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee6f57", "parentcaller": "0x6af065db", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7526 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7527 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7528 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7529 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca2d6", "parentcaller": "0x6af0505c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7530 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af06d41", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LatestRecommendedVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LatestRecommendedVersion" } ], "repeated": 0, "id": 7531 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06d58", "parentcaller": "0x6af065ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7532 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7533 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7534 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee5972", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7535 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee597f", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7536 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee5992", "parentcaller": "0x6af06660", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7537 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aee58f4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7538 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7539 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastCheckSuccess" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780051492" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LastCheckSuccess" } ], "repeated": 0, "id": 7540 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6aee591e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7541 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7542 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af10c62", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7543 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 7544 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_USERS\\" } ], "repeated": 0, "id": 7545 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af1d218", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "6" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7546 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": ".DEFAULT" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT" } ], "repeated": 0, "id": 7547 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7548 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": ".DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7549 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "S-1-5-19" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19" } ], "repeated": 0, "id": 7550 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7551 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7552 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "S-1-5-20" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20" } ], "repeated": 0, "id": 7553 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7554 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7555 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7556 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7557 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7558 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" } ], "repeated": 0, "id": 7559 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7560 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7561 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af1d243", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "S-1-5-18" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 7562 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7563 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7564 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000074c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7565 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000074c" }, { "name": "ValueName", "value": "dr" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\dr" } ], "repeated": 0, "id": 7566 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d7ab", "parentcaller": "0x6af1d3d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7567 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af1d3f2", "parentcaller": "0x6af076df", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7568 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6af07463", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7569 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7570 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af07501", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "RollCallDayStartSec" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780012800" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec" } ], "repeated": 0, "id": 7571 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6af0755e", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfLastRollCall" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "7088" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall" } ], "repeated": 0, "id": 7572 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af07590", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ping_freshness" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "{97190DC5-4AC1-4DB5-BAF4-9EE181B5845C}" }, { "name": "BufferLength", "value": "78" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness" } ], "repeated": 0, "id": 7573 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af075b1", "parentcaller": "0x6af076ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7574 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7575 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7576 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "DayOfInstall" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall" } ], "repeated": 0, "id": 7577 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af0766f", "parentcaller": "0x6af0770a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7578 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 1, "id": 7579 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7580 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6af06c26", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "tttoken" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken" } ], "repeated": 0, "id": 7581 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06c6b", "parentcaller": "0x6af065a8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7582 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7583 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7584 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f13", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "rrf@0.45" }, { "name": "BufferLength", "value": "18" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)" } ], "repeated": 0, "id": 7585 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f2b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "hint" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint" } ], "repeated": 0, "id": 7586 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6aee6f3d", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name" } ], "repeated": 0, "id": 7587 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee6f57", "parentcaller": "0x6af065db", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7588 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7589 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca267", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7590 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecab2d", "parentcaller": "0x6af06d41", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LatestRecommendedVersion" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "" }, { "name": "BufferLength", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LatestRecommendedVersion" } ], "repeated": 0, "id": 7591 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06d58", "parentcaller": "0x6af065ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7592 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7593 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7594 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee5972", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7595 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca0e1", "parentcaller": "0x6aee597f", "category": "registry", "api": "RegDeleteValueW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7596 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aee5992", "parentcaller": "0x6af06660", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7597 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aee58f4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7598 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7599 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastCheckSuccess" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780051492" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LastCheckSuccess" } ], "repeated": 0, "id": 7600 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6aee591e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7601 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7602 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 7603 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7604 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xf3K\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\xf4K\\x05?=\\xffj\t\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x80;\\x93\\x02\\xc0\\xf4K\\x05\\x00\\x00\\x00\\x00(\\xf4K\\x05" } ], "repeated": 0, "id": 7605 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7606 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000073c" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 7607 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7608 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 7609 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7610 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 1, "id": 7611 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aed9238", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7612 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 7613 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastChecked" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "1780051492" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastChecked" } ], "repeated": 0, "id": 7614 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6aed9281", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7615 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 7616 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7617 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7618 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7619 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7620 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7621 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7622 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7623 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7624 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7625 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7626 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7627 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7628 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7629 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7630 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7631 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7632 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7633 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7634 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7635 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7636 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7637 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7638 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6aef8042", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7639 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aed7b9b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7640 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77506ca7", "parentcaller": "0x6aed7b9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7641 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 7642 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7643 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 7644 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7645 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 7646 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7647 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xf2K\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x1c\\x00\\x0e\\x00X\\x88y\\x03\\xf0\\x8fy\\x038\\x98x\\x03 \\x00\\x00\\x00\\x1d\\x00\t\\x00 \\x00\\x00\\x00\\x1d\\x00\\x1b\\x00\\xd0\\xf3K\\x05l\\x88y\\x03\\xc8\\xf3K\\x05" } ], "repeated": 0, "id": 7648 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 7649 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000734" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 7650 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7651 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 7652 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7653 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 7654 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7655 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7656 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7657 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06f35", "parentcaller": "0x6aef7e2e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7658 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7659 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7660 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7661 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7662 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7663 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7664 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7665 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7666 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7667 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7668 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7669 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7670 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7671 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7672 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7673 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7674 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7675 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7676 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\" } ], "repeated": 0, "id": 7677 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6af04744", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 7678 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7679 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7680 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6af0476d", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 7681 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04aa0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7682 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af047b8", "parentcaller": "0x6af04d78", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7683 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 7684 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7685 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7686 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06f35", "parentcaller": "0x6aef7efa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7687 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7688 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 7689 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableCount" } ], "repeated": 0, "id": 7690 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "UpdateAvailableSince" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableSince" } ], "repeated": 0, "id": 7691 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6af06f35", "parentcaller": "0x6aef7efa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7692 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aec59f9", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 7693 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x75fb1708", "parentcaller": "0x6aef8de7", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "5" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7694 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774aa06b", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000073c", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 7695 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774a87fe", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 7696 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 7697 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aebdc26", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\State" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\State" } ], "repeated": 0, "id": 7698 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "ImageState" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState" } ], "repeated": 0, "id": 7699 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "ImageState" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IMAGE_STATE_COMPLETE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState" } ], "repeated": 0, "id": 7700 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6aebdcae", "parentcaller": "0x6aef8e1f", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7701 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 2, "id": 7702 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6aec71ed", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000073c" } ], "repeated": 0, "id": 7703 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec7210", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 7704 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec7241", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7705 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6aebbb95", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000073c" } ], "repeated": 0, "id": 7706 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec0354", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7707 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec03ac", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xf8K\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 7708 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7709 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a917f", "parentcaller": "0x6aec90d7", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 7710 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "WTSGetActiveConsoleSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb2140" } ], "repeated": 0, "id": 7711 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6ae754ea", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000073c" } ], "repeated": 0, "id": 7712 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6ae7550a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7713 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6ae75534", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7714 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7715 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x766f0f20", "parentcaller": "0x766ee30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7716 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7717 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x766f0f20", "parentcaller": "0x766ee30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7718 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7719 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x766f0f20", "parentcaller": "0x766ee30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7720 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 7721 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x766f0f20", "parentcaller": "0x766ee30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 7722 }, { "timestamp": "2026-05-29 10:44:52,628", "thread_id": "10276", "caller": "0x6ae73a05", "parentcaller": "0x6ae74071", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7723 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x6aec7e1e", "parentcaller": "0x6aecbfb6", "category": "process", "api": "K32EnumProcesses", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 7724 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6aec9059", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000028" }, { "name": "TokenHandle", "value": "0x0000073c" } ], "repeated": 0, "id": 7725 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7726 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "LookupPrivilegeValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6a230" } ], "repeated": 0, "id": 7727 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7728 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x6aec9073", "parentcaller": "0x6aec7e3c", "category": "system", "api": "LookupPrivilegeValueW", "status": true, "return": "0x00000001", "arguments": [ { "name": "SystemName", "value": "" }, { "name": "PrivilegeName", "value": "SeDebugPrivilege" } ], "repeated": 0, "id": 7729 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7730 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "AdjustTokenPrivileges" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ff70" } ], "repeated": 0, "id": 7731 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7732 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec90bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7733 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6aebbb95", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000073c" } ], "repeated": 0, "id": 7734 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec0354", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 7735 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec03ac", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xe7K\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 7736 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7737 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4" }, { "name": "ProcessName", "value": "Error obtaining target process name" } ], "repeated": 0, "id": 7738 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7739 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "124" }, { "name": "ProcessName", "value": "" } ], "repeated": 0, "id": 7740 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7741 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "384" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\smss.exe" } ], "repeated": 0, "id": 7742 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7743 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "480" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\csrss.exe" } ], "repeated": 0, "id": 7744 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7745 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "556" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\wininit.exe" } ], "repeated": 0, "id": 7746 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7747 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "576" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\csrss.exe" } ], "repeated": 0, "id": 7748 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7749 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7750 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "576" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\csrss.exe" } ], "repeated": 0, "id": 7751 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7752 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7753 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7754 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7755 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "PathFindFileNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76194e90" } ], "repeated": 0, "id": 7756 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7757 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7758 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "656" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\winlogon.exe" } ], "repeated": 0, "id": 7759 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7760 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7761 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "656" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\winlogon.exe" } ], "repeated": 0, "id": 7762 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7763 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7764 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7765 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7766 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "676" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\services.exe" } ], "repeated": 0, "id": 7767 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7768 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "724" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\lsass.exe" } ], "repeated": 0, "id": 7769 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7770 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "832" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7771 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7772 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\fontdrvhost.exe" } ], "repeated": 0, "id": 7773 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7774 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "868" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\fontdrvhost.exe" } ], "repeated": 0, "id": 7775 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7776 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7777 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "868" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\fontdrvhost.exe" } ], "repeated": 0, "id": 7778 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7779 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7780 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7781 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7782 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "948" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7783 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7784 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1004" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7785 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7786 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "472" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7787 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7788 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "772" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7789 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7790 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1048" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\dwm.exe" } ], "repeated": 0, "id": 7791 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7792 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7793 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1048" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\dwm.exe" } ], "repeated": 0, "id": 7794 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7795 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7796 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7797 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7798 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1096" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7799 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7800 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1136" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7801 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7802 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1164" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7803 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7804 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1268" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7805 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7806 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1284" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7807 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7808 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1292" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7809 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7810 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1308" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7811 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7812 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1352" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7813 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7814 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1444" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7815 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7816 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1596" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7817 }, { "timestamp": "2026-05-29 10:44:52,643", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7818 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1632" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7819 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7820 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1644" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7821 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7822 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1664" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7823 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7824 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1828" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7825 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7826 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1852" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7827 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7828 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1860" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7829 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7830 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1868" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7831 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7832 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1992" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7833 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7834 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2020" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7835 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7836 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2036" }, { "name": "ProcessName", "value": "" } ], "repeated": 0, "id": 7837 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7838 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2124" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7839 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7840 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2224" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7841 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7842 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2240" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7843 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7844 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2296" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7845 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7846 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2344" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7847 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7848 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2456" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7849 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7850 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2472" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7851 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7852 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2520" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7853 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7854 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2696" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\spoolsv.exe" } ], "repeated": 0, "id": 7855 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7856 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2724" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7857 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7858 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2772" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7859 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7860 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2876" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7861 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7862 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2896" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7863 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7864 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3012" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7865 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7866 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3020" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7867 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7868 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3040" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7869 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7870 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3048" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7871 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7872 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3056" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7873 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7874 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2292" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7875 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7876 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2820" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7877 }, { "timestamp": "2026-05-29 10:44:52,659", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7878 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3396" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7879 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7880 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3892" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\SearchIndexer.exe" } ], "repeated": 0, "id": 7881 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7882 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3992" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7883 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7884 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3500" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\sihost.exe" } ], "repeated": 0, "id": 7885 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7886 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7887 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3500" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\sihost.exe" } ], "repeated": 0, "id": 7888 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7889 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7890 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7891 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7892 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3416" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7893 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7894 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7895 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3416" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7896 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7897 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7898 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7899 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7900 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4148" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7901 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7902 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7903 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4148" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7904 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7905 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7906 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7907 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7908 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4240" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\taskhostw.exe" } ], "repeated": 0, "id": 7909 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7910 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7911 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4240" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\taskhostw.exe" } ], "repeated": 0, "id": 7912 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7913 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7914 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7915 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7916 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4300" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7917 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7918 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4380" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7919 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7920 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "C:\\Windows\\explorer.exe" } ], "repeated": 0, "id": 7921 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7922 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7923 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "C:\\Windows\\explorer.exe" } ], "repeated": 0, "id": 7924 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7925 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7926 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7927 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7928 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4524" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\ctfmon.exe" } ], "repeated": 0, "id": 7929 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7930 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7931 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4524" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\ctfmon.exe" } ], "repeated": 0, "id": 7932 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7933 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7934 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7935 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7936 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4592" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7937 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7938 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4788" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7939 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7940 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4916" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7941 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7942 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7943 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4916" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7944 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7945 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7946 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7947 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7948 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5200" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7949 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7950 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5260" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7951 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7952 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5544" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7953 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7954 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe" } ], "repeated": 0, "id": 7955 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7956 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7957 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5624" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe" } ], "repeated": 0, "id": 7958 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7959 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7960 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7961 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7962 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5688" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7963 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7964 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7965 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5688" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7966 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7967 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7968 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7969 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7970 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5800" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7971 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7972 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5892" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7973 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7974 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6008" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 7975 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7976 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp.exe" } ], "repeated": 0, "id": 7977 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7978 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7979 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6136" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp.exe" } ], "repeated": 0, "id": 7980 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7981 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7982 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7983 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7984 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5948" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7985 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7986 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7987 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5948" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7988 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7989 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 7990 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7991 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7992 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6436" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7993 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 7994 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 7995 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6436" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 7996 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 7997 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 7998 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 7999 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8000 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6616" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\taskhostw.exe" } ], "repeated": 0, "id": 8001 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8002 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8003 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6616" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\taskhostw.exe" } ], "repeated": 0, "id": 8004 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8005 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8006 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8007 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8008 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6996" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\smartscreen.exe" } ], "repeated": 0, "id": 8009 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8010 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8011 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6996" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\smartscreen.exe" } ], "repeated": 0, "id": 8012 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8013 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8014 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8015 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8016 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7052" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\SecurityHealthSystray.exe" } ], "repeated": 0, "id": 8017 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8018 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8019 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7052" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\SecurityHealthSystray.exe" } ], "repeated": 0, "id": 8020 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8021 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8022 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8023 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8024 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7088" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\SecurityHealthService.exe" } ], "repeated": 0, "id": 8025 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8026 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6284" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8027 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8028 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1180" } ], "repeated": 0, "id": 8029 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3976" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\conhost.exe" } ], "repeated": 0, "id": 8030 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8031 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8032 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3976" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\conhost.exe" } ], "repeated": 0, "id": 8033 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8034 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8035 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8036 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8037 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "484" } ], "repeated": 0, "id": 8038 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1104" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" } ], "repeated": 0, "id": 8039 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8040 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8041 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1104" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" } ], "repeated": 0, "id": 8042 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8043 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8044 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8045 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8046 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8047 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8048 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8049 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5128" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8050 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8051 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8052 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8053 }, { "timestamp": "2026-05-29 10:44:52,674", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8054 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6768" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" } ], "repeated": 0, "id": 8055 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8056 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8057 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6768" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\steam.exe" } ], "repeated": 0, "id": 8058 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8059 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8060 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8061 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8062 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8063 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8064 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8065 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6400" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8066 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8067 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8068 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8069 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8070 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6356" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Common Files\\Steam\\steamservice.exe" } ], "repeated": 0, "id": 8071 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8072 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6360" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8073 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8074 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8075 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6360" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8076 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8077 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8078 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8079 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8080 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6392" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8081 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8082 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8083 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6392" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8084 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8085 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8086 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8087 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8088 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2160" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8089 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8090 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8091 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2160" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8092 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8093 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8094 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8095 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8096 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6512" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8097 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8098 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8099 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6512" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8100 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8101 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8102 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8103 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8104 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6504" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8105 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8106 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8107 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6504" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8108 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8109 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8110 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8111 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8112 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7444" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8113 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8114 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8115 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7444" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8116 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8117 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000658" } ], "repeated": 0, "id": 8118 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8119 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8120 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7544" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8121 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8122 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8123 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7544" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8124 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8125 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8126 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8127 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8128 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7844" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8129 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8130 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8131 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7844" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8132 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8133 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8134 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8135 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8136 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8100" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8137 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8138 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8139 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8100" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8140 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8141 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8142 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8143 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8144 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8340" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8145 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8146 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8147 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8340" }, { "name": "ProcessName", "value": "C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe" } ], "repeated": 0, "id": 8148 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8149 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8150 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8151 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8152 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8108" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8153 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8154 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3820" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8155 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8156 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8157 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3820" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe" } ], "repeated": 0, "id": 8158 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8159 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8160 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8161 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8162 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8044" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" } ], "repeated": 0, "id": 8163 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8164 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8165 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8044" }, { "name": "ProcessName", "value": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe" } ], "repeated": 0, "id": 8166 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8167 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8168 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8169 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8170 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1740" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\dllhost.exe" } ], "repeated": 0, "id": 8171 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8172 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8173 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1740" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\dllhost.exe" } ], "repeated": 0, "id": 8174 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8175 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8176 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8177 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8178 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1316" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8179 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8180 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "3404" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8181 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8182 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5364" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\SgrmBroker.exe" } ], "repeated": 0, "id": 8183 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8184 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6640" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8185 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8186 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8187 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6640" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8188 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8189 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000658" } ], "repeated": 0, "id": 8190 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8191 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8192 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2580" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8193 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8194 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6028" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\MoUsoCoreWorker.exe" } ], "repeated": 0, "id": 8195 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8196 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6188" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8197 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8198 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6320" } ], "repeated": 0, "id": 8199 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6408" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8200 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8201 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5116" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\backgroundTaskHost.exe" } ], "repeated": 0, "id": 8202 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8203 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8204 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5116" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\backgroundTaskHost.exe" } ], "repeated": 0, "id": 8205 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8206 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8207 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8208 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8209 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8828" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\CompatTelRunner.exe" } ], "repeated": 0, "id": 8210 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8211 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6280" }, { "name": "ProcessName", "value": "C:\\Windows\\servicing\\TrustedInstaller.exe" } ], "repeated": 0, "id": 8212 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8213 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1028" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\notepad.exe" } ], "repeated": 0, "id": 8214 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8215 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8216 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1028" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\notepad.exe" } ], "repeated": 0, "id": 8217 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8218 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8219 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8220 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8221 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4932" }, { "name": "ProcessName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe" } ], "repeated": 0, "id": 8222 }, { "timestamp": "2026-05-29 10:44:52,690", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8223 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1016" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 8224 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8225 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8226 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1016" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 8227 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8228 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000744" } ], "repeated": 0, "id": 8229 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8230 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8231 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2016" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\conhost.exe" } ], "repeated": 0, "id": 8232 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "9284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9284" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "SslEncryptPacket" }, { "name": "FunctionAddress", "value": "0x70d03e20" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 8233 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "9284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9284" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "SslDecryptPacket" }, { "name": "FunctionAddress", "value": "0x70d03be0" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 8234 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "9284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9284" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "NCryptImportKey" }, { "name": "FunctionAddress", "value": "0x70d02ff0" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 8235 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "9284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9284" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "NCryptDecrypt" }, { "name": "FunctionAddress", "value": "0x70d0e840" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 8236 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "9284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9284" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "NCryptEncrypt" }, { "name": "FunctionAddress", "value": "0x70d0e970" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 8237 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2672" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 8238 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8239 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8240 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2672" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\RuntimeBroker.exe" } ], "repeated": 0, "id": 8241 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8242 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8243 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8244 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8245 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6568" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\CompatTelRunner.exe" } ], "repeated": 0, "id": 8246 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8247 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5040" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\sppsvc.exe" } ], "repeated": 0, "id": 8248 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8249 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2916" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8250 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8251 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8700" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" } ], "repeated": 0, "id": 8252 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8253 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4104" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8254 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8255 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8256 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4104" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8257 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8258 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8259 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8260 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8261 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1204" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8262 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8263 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8264 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1204" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8265 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8266 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8267 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8268 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8269 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2168" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8270 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8271 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8272 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2168" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8273 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8274 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000758" } ], "repeated": 0, "id": 8275 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8276 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8277 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1332" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8278 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8279 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8280 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "1332" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8281 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8282 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8283 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8284 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8285 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4760" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8286 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8287 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8288 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4760" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8289 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8290 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8291 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8292 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8293 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4108" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8294 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8295 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8296 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4108" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8297 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8298 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8299 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8300 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8301 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5820" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8302 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8303 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8304 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "5820" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8305 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8306 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8307 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8308 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8309 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8604" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8310 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8311 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8504" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" } ], "repeated": 0, "id": 8312 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8313 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7080" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" } ], "repeated": 0, "id": 8314 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8315 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9328" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8316 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8317 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8318 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9328" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8319 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8320 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8321 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8322 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8323 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9344" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8324 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8325 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 8326 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec827c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9344" }, { "name": "ProcessName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" } ], "repeated": 0, "id": 8327 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cf9e4", "parentcaller": "0x6aeccd28", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "FILE_READ_ACCESS" }, { "name": "ObjectAttributes", "value": "C:\\??" } ], "repeated": 0, "id": 8328 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfad4", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8329 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774cfb23", "parentcaller": "0x6aeccd28", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8330 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8398", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8331 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9568" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8332 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8333 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c10", "parentcaller": "0x6aec7f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "2464" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8334 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x77503c34", "parentcaller": "0x6aec7f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8335 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8336 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9278", "parentcaller": "0x6aec702e", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "4484" }, { "name": "ProcessName", "value": "C:\\Windows\\System32\\svchost.exe" } ], "repeated": 0, "id": 8337 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774ac134", "parentcaller": "0x6aec7041", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x00000018" }, { "name": "TokenHandle", "value": "0x00000734" } ], "repeated": 0, "id": 8338 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec7059", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 8339 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a9e76", "parentcaller": "0x6aec7082", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x87\\x97\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 8340 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8341 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSidIdentifierAuthority" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e85fe0" } ], "repeated": 0, "id": 8342 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8343 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8344 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSidSubAuthorityCount" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f2c0" } ], "repeated": 0, "id": 8345 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8346 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec70a2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8347 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec70a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8348 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8349 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoUninitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f27fd0" } ], "repeated": 0, "id": 8350 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8351 }, { "timestamp": "2026-05-29 10:44:52,706", "thread_id": "10276", "caller": "0x774a917f", "parentcaller": "0x76f26a20", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" } ], "repeated": 0, "id": 8352 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000764" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8353 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8354 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8355 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000075c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 8356 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8357 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8358 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" }, { "name": "Disposition", "value": "1", "pretty_value": "REG_CREATED_NEW_KEY" } ], "repeated": 0, "id": 8359 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8360 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8361 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000075c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8362 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8363 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8364 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8365 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8366 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8367 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca1ca", "parentcaller": "0x6aeca4b3", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x0000075c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8368 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecaac8", "parentcaller": "0x6aeca51b", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "StateValue" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Buffer", "value": "16" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState\\StateValue" } ], "repeated": 0, "id": 8369 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca570", "parentcaller": "0x6af0ed4a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8370 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774d411b", "parentcaller": "0x6aed7b9b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 8371 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x77506ca7", "parentcaller": "0x6aed7b9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8372 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe3K\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x88\\x00\\x00\\x008\\x8cy\\x03p\\xf5y\\x03X\\x88y\\x03`\\x00\\x00\\x00\\xd0\\x07\\xc0\\x04\\x14{\\x82w\\xa0\\x8ay\\x03\\x00\\x00:\\x03\\x00\\x00\\x00\\x008\\xf6y\\x03" } ], "repeated": 0, "id": 8373 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8374 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000073c" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 8375 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8376 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 8377 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8378 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8379 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 8380 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed7aee", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8381 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8382 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted" } ], "repeated": 0, "id": 8383 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed2f83", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8384 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8385 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8386 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 8387 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed7aee", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8388 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 8389 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 8390 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6aed286f", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 8391 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed2895", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8392 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8393 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 8394 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8395 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed2895", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8396 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8397 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 8398 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51a1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8399 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8400 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 8401 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee51e2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8402 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8403 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aed28dd", "parentcaller": "0x6aed9fd6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8404 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8405 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 8406 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aed9ff4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8407 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards" } ], "repeated": 0, "id": 8408 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecb42d", "parentcaller": "0x6aed9534", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "1" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 8409 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecb47e", "parentcaller": "0x6aed9570", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "2" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 8410 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aed95ba", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000734" }, { "name": "SubKey", "value": "2" }, { "name": "Handle", "value": "0x0000073c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2" } ], "repeated": 0, "id": 8411 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 8412 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000073c" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName" } ], "repeated": 0, "id": 8413 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000074c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\{4C572733-2FBA-4346-9601-F86DBA666EF2}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8414 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aed968e", "parentcaller": "0x6aed99b8", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000074c" }, { "name": "IoControlCode", "value": "0x00170002" }, { "name": "InBuffer", "value": "\\x01\\x01\\x01\\x01" }, { "name": "OutBuffer", "value": "\\x00\\x1b!:|\\xd4" } ], "repeated": 0, "id": 8415 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aed9712", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000074c" } ], "repeated": 0, "id": 8416 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aed974f", "parentcaller": "0x6aed99b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8417 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aed9798", "parentcaller": "0x6aed99b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8418 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecac4a", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 8419 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecac5a", "parentcaller": "0x6aed9a36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8420 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\uid" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 8421 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aed9a85", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "ABshOnzU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU" } ], "repeated": 0, "id": 8422 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aed9aba", "parentcaller": "0x6aeda006", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8423 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8424 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 8425 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{BEFBCB77-63F8-429E-8863-F0DC8214DEE6}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } ], "repeated": 0, "id": 8426 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8427 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 2, "id": 8428 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 8429 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 1, "id": 8430 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6af64af4", "parentcaller": "0x6af5da3c", "category": "misc", "api": "GlobalMemoryStatusEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "MemoryLoad", "value": "17" }, { "name": "TotalPhysicalMB", "value": "8191" } ], "repeated": 0, "id": 8431 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8432 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774a8f9b", "parentcaller": "0x774a8a9e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000734" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8433 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec8a92", "parentcaller": "0x6af64b85", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000734" }, { "name": "IoControlCode", "value": "0x002d1400", "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY" }, { "name": "InBuffer", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa6\\x8e\\x02\\xe0\\x81\r\\x06\\x93\\x0f\\x190\\x9c\\xe9K\\x05\\x85K\\xf6j$\\xba\\x93\\x02(\\xba\\x93\\x02\\xd8r\r\\x06\\x00\\x00\\x00\\x00$\\xba\\x93\\x02\\x18|\\x90\\x02\\x00\\x00\\x00\\x00{\\xff\\xffA\\x00\\x00\\x01\\x00\\x0c\\xba\\x93\\x02@\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\xb0\\xf7\\xff\\x01\\x00\\x00\\x00\\x00\\x00\t\\xa6\\x01\\x00\\x00\\x00\\x00\\xb0\\xf7w\\x02\\x00\\x00\\x00\\x00\\xe0\\x1e\\xb6\\x01\\x00\\x00\\x00\\x00\\x00\\xfe\\x7f\\x00\\x00\\x00\\x00\\x00P\\xbcv\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|j\r\\x06\\x98\\xe9K\\x05\\xbfb~wa\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\xd0\\x07>\\x02d\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x91\\x90\\x02hj\r\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00" } ], "repeated": 0, "id": 8434 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec8ad0", "parentcaller": "0x6af64b85", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000734" }, { "name": "IoControlCode", "value": "0x002d1400", "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY" }, { "name": "InBuffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x0c\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 8435 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aec8ae9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8436 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6af64baa", "parentcaller": "0x6af5da3c", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8437 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 8438 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x777a0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8439 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlGetVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777cff50" } ], "repeated": 0, "id": 8440 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x6aec6103", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8441 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 8442 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "UBR" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 8443 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aed8958", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8444 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d003d", "parentcaller": "0x774ae8fd", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8445 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x7780d4ea", "parentcaller": "0x774d12da", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8446 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x7780d524", "parentcaller": "0x774d12da", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfoLegacyMapping" }, { "name": "Type", "value": "0x00000003" } ], "repeated": 0, "id": 8447 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aebe0ae", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\WindowsSelfHost\\Applicability" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfHost\\Applicability" } ], "repeated": 0, "id": 8448 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "EnablePreviewBuilds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds" } ], "repeated": 0, "id": 8449 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aebe10f", "parentcaller": "0x6af64ca2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8450 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" }, { "name": "BaseAddress", "value": "0x74a30000" } ], "repeated": 0, "id": 8451 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aa206", "parentcaller": "0x6aebf4d0", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74a30000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\wldp.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8452 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "ModuleHandle", "value": "0x74a30000" }, { "name": "FunctionName", "value": "WldpQueryWindowsLockdownMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74a37dd0" } ], "repeated": 0, "id": 8453 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x74a37e12", "parentcaller": "0x6af64cff", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 8454 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 8455 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "SystemManufacturer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ], "repeated": 0, "id": 8456 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "SystemManufacturer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "ASUS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ], "repeated": 0, "id": 8457 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8458 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 8459 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "SystemProductName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName" } ], "repeated": 0, "id": 8460 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "SystemProductName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PRIME B450M-A II" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName" } ], "repeated": 0, "id": 8461 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8462 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 8463 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 8464 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "\"Z4YNAWPMOlHJbvgX3eb6sgxxvBAjTfZLbRpNgdduL+o=\"" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 8465 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8466 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aebcc05", "parentcaller": "0x6aecee1a", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00004026", "pretty_value": "CSIDL_FLAG_DONT_VERIFY|CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 8467 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3" } ], "repeated": 0, "id": 8468 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 8469 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft" } ], "repeated": 0, "id": 8470 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate" } ], "repeated": 0, "id": 8471 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774aa06b", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000073c", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 8472 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774a88d6", "parentcaller": "0x774a87fe", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 8473 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8474 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8475 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "updatefreqhourshint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatefreqhourshint" } ], "repeated": 0, "id": 8476 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aee6438", "parentcaller": "0x6af10a38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8477 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8478 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8479 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8480 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aedb799", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8481 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8482 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8483 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8484 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8485 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8486 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x98?\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8487 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x98?\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8488 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x98?\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8489 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x98?\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8490 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8491 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8492 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\optedintoinsider" } ], "repeated": 0, "id": 8493 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8494 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8495 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "rollbackrequested" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\rollbackrequested" } ], "repeated": 0, "id": 8496 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee4060", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8497 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 5, "id": 8498 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8499 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\optedintoinsider" } ], "repeated": 0, "id": 8500 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8501 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8502 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xf4@\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8503 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4@\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8504 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xf4@\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8505 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf4@\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8506 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8507 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8508 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels" } ], "repeated": 0, "id": 8509 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aeecd3d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8510 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8511 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels" } ], "repeated": 0, "id": 8512 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aeecd8b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8513 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeeca9f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8514 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8515 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_control_labels" } ], "repeated": 0, "id": 8516 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aedb799", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8517 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeeca9f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 8518 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8519 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "updatefreqhourshint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatefreqhourshint" } ], "repeated": 0, "id": 8520 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aee6438", "parentcaller": "0x6af10a38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8521 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8522 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8523 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8524 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aedb799", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8525 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8526 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8527 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8528 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8529 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8530 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\B\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8531 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\B\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8532 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\B\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8533 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\B\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8534 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8535 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8536 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\optedintoinsider" } ], "repeated": 0, "id": 8537 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8538 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8539 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "rollbackrequested" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\rollbackrequested" } ], "repeated": 0, "id": 8540 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee4060", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8541 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 8542 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8543 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\optedintoinsider" } ], "repeated": 0, "id": 8544 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8545 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8546 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xb8C\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8547 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb8C\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8548 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xb8C\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8549 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb8C\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8550 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8551 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8552 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_labels" } ], "repeated": 0, "id": 8553 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aeecd3d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8554 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8555 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeeca9f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8556 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8557 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8558 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aedb799", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8559 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8560 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8561 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8562 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8563 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeeca9f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 8564 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8565 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "updatefreqhourshint" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatefreqhourshint" } ], "repeated": 0, "id": 8566 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aee6438", "parentcaller": "0x6af10a38", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8567 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8568 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aecade7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8569 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca098", "parentcaller": "0x6aecadf4", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8570 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aecae04", "parentcaller": "0x6aedb799", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8571 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8572 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8573 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 8574 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aecc84c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8575 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8576 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00 E\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8577 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " E\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8578 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00 E\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8579 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " E\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8580 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8581 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8582 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\optedintoinsider" } ], "repeated": 0, "id": 8583 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8584 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8585 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 8586 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca333", "parentcaller": "0x6aeca628", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000734" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8587 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000734" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\optedintoinsider" } ], "repeated": 0, "id": 8588 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aeca6e4", "parentcaller": "0x6aee3f54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8589 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8590 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00|F\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8591 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "|F\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8592 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00|F\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8593 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "|F\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8594 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8595 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774b9924", "parentcaller": "0x6aebd47d", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000003c8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000734" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 8596 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x7782fcba", "parentcaller": "0x77808f3a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000073c" } ], "repeated": 0, "id": 8597 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af0dcbf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 8598 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774d411b", "parentcaller": "0x6aed7b9b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 8599 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af0dcbf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 8600 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x77506ca7", "parentcaller": "0x6aed7b9b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8601 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x75377010", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 8602 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x7537705e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 8603 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f109f", "parentcaller": "0x777ef039", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "DPAPI.DLL" } ], "repeated": 0, "id": 8604 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x6af3c1f1", "parentcaller": "0x6af5e6dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "88D96A05-F192-11D4-A65F-0040963251E5" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "2933BF81-7B36-11D2-B20E-00C04F983E60" }, { "name": "ProgID", "value": "Msxml2.DOMDocument.6.0" } ], "repeated": 0, "id": 8605 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f213c", "parentcaller": "0x777f2046", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" } ], "repeated": 0, "id": 8606 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05e52000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8607 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6f1238b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8608 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6f1258f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" } ], "repeated": 0, "id": 8609 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6f1238b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8610 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x88\\xf1\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x96~\\x90\\x02XJ\\x10\\x06L\\x00\\x00\\x00d\\xf2\\x0b\\x06\\xac\\xf6\\x0b\\x06\\xda\\xff\\xff\\xff\\xac\\xf6\\x0b\\x06\\xf0\\xf1\\x0b\\x06\\xfa)\\xffjXJ\\x10\\x06&\\x00\\x00\\x00" } ], "repeated": 0, "id": 8611 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000764" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8612 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000768" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000764" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 8613 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8614 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000768" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 8615 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" } ], "repeated": 0, "id": 8616 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x6aeca333", "parentcaller": "0x6aeca3b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000768" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 8617 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000768" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 8618 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000768" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.3.233.3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 8619 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x6aee5ab9", "parentcaller": "0x6af5e4e7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" } ], "repeated": 0, "id": 8620 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x6aebcc05", "parentcaller": "0x6aecee1a", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00004026", "pretty_value": "CSIDL_FLAG_DONT_VERIFY|CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 8621 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3" } ], "repeated": 0, "id": 8622 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 8623 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f122c", "parentcaller": "0x777f1397", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000760" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8624 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft" } ], "repeated": 0, "id": 8625 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774cab2e", "parentcaller": "0x6aec0962", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate" } ], "repeated": 0, "id": 8626 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f000f", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e5000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8627 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f00b7", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8628 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f00e5", "parentcaller": "0x777f0794", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8629 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x77801ea8", "parentcaller": "0x77801e31", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8630 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x77801ea8", "parentcaller": "0x77801e61", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8631 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777d9d5b", "parentcaller": "0x777eb4a0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8632 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777fe6ed", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000760" } ], "repeated": 0, "id": 8633 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777fe6f5", "parentcaller": "0x777fe3a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 8634 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8635 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777f0d10", "parentcaller": "0x777de4a3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x6e2e0000" } ], "repeated": 0, "id": 8636 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x774906cf", "parentcaller": "0x7748eadc", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000075c" }, { "name": "ThreadHandle", "value": "0x00000764" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "11132" } ], "repeated": 0, "id": 8637 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10416", "caller": "0x74b789df", "parentcaller": "0x74b7834c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8638 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777edd72", "parentcaller": "0x777f1873", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dpapi" }, { "name": "BaseAddress", "value": "0x6e2e0000" }, { "name": "InitRoutine", "value": "0x6e2e1dc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 8639 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8640 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8641 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af34bf5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000554" } ], "repeated": 0, "id": 8642 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af34c04", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 8643 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af2fcbf", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 8644 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6af3387d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 8645 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aef7b92", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 8646 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 8647 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 8648 }, { "timestamp": "2026-05-29 10:44:52,721", "thread_id": "10276", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c8" } ], "repeated": 0, "id": 8649 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774aa206", "parentcaller": "0x75fa7ea0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 8650 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x75fa59e0", "parentcaller": "0x75fa542e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\apphelp" }, { "name": "DllBase", "value": "0x74960000" } ], "repeated": 0, "id": 8651 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774aa206", "parentcaller": "0x74995b04", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 8652 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x75fa59e0", "parentcaller": "0x75fa542e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\apphelp.dll" }, { "name": "BaseAddress", "value": "0x74960000" } ], "repeated": 0, "id": 8653 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x75fa59e0", "parentcaller": "0x75fa542e", "category": "process", "api": "CreateProcessW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ProcessId", "value": "11132" }, { "name": "ThreadId", "value": "11136" }, { "name": "ProcessHandle", "value": "0x0000075c" }, { "name": "ThreadHandle", "value": "0x00000764" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8654 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x6aec209f", "parentcaller": "0x6aeb8ba4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 8655 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774b7303", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x94I\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8656 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774b7282", "parentcaller": "0x6aeb9a8f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x94I\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8657 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774b7303", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x94I\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8658 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774b7282", "parentcaller": "0x6aeb9abf", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x94I\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8659 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774add70", "parentcaller": "0x6aeb9bda", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8660 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774d411b", "parentcaller": "0x6aebc061", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 8661 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6aebbc5e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" } ], "repeated": 0, "id": 8662 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x777cf655", "parentcaller": "0x777e46e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060f8000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8663 }, { "timestamp": "2026-05-29 10:44:52,737", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6aed82fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8664 }, { "timestamp": "2026-05-29 10:44:52,768", "thread_id": "10276", "caller": "0x766f0f20", "parentcaller": "0x766e117e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8665 }, { "timestamp": "2026-05-29 10:44:52,768", "thread_id": "10276", "caller": "0x766e1284", "parentcaller": "0x766e121d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 8666 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6af5e5fb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8667 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x777f3909", "parentcaller": "0x777cd7a4", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xf1\\x0b\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xe6u\\x90\\x02\\x18^\r\\x06\\x1c\\x00\\x00\\x00L\\x00\\x00\\x00&\\x00\\x00\\x00\\x03+\\xffj||\\x90\\x02\\x80\\xc4\\x93\\x02L\\x00\\x00\\x00\\xcc\\xf2\\x0b\\x06\\x14\\xf7\\x0b\\x06" } ], "repeated": 0, "id": 8668 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x777cd7d7", "parentcaller": "0x7749adb9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000075c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 8669 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aedea", "parentcaller": "0x77497f43", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000764" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000075c" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 8670 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aee1d", "parentcaller": "0x77497f43", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8671 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x77494730", "parentcaller": "0x774b1dc2", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000764" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 8672 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774feb3c", "parentcaller": "0x7751fd15", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000764" } ], "repeated": 0, "id": 8673 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x6aeca333", "parentcaller": "0x6aecac4a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{753D568D-CA29-4956-AA4C-D2F6B81FE1F8}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{753D568D-CA29-4956-AA4C-D2F6B81FE1F8}" } ], "repeated": 0, "id": 8674 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6af01dba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000734" } ], "repeated": 0, "id": 8675 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8676 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75810000" }, { "name": "FunctionName", "value": "PostThreadMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7584b340" } ], "repeated": 0, "id": 8677 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8678 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x6aef2de0", "parentcaller": "0x6af041ea", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "5932" }, { "name": "ThreadId", "value": "10256" }, { "name": "Message", "value": "18" } ], "repeated": 0, "id": 8679 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774a917f", "parentcaller": "0x76f26a20", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" } ], "repeated": 0, "id": 8680 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8681 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoRevokeClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ef1280" } ], "repeated": 0, "id": 8682 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8683 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774a917f", "parentcaller": "0x76f26a20", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" } ], "repeated": 0, "id": 8684 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8685 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegisterEventSourceW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70b60" } ], "repeated": 0, "id": 8686 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8687 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 8688 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ac" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Rpc\\SecurityService" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\SecurityService" } ], "repeated": 0, "id": 8689 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774eec2a", "parentcaller": "0x7749ef5e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003ac" }, { "name": "ValueName", "value": "DefaultAuthLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\SecurityService\\DefaultAuthLevel" } ], "repeated": 0, "id": 8690 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774a040b", "parentcaller": "0x766e301e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 8691 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8692 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8693 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "ReportEventW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70ef0" } ], "repeated": 0, "id": 8694 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8695 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x75e7111c", "parentcaller": "0x75e71038", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8696 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8697 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "DeregisterEventSource" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70e50" } ], "repeated": 0, "id": 8698 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8699 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x766efc08", "parentcaller": "0x766efabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000654" } ], "repeated": 0, "id": 8700 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x7780b6b6", "parentcaller": "0x75fafcd0", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10256" } ], "repeated": 0, "id": 8701 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x7670d5f4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 8702 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x774aab1a", "parentcaller": "0x7670d676", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 8703 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10256", "caller": "0x7780b6d9", "parentcaller": "0x75fafcd0", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 8704 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 8705 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 8706 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 1, "id": 8707 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 8708 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 8709 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x000003b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 8710 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 8711 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8712 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 8713 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003c0" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 8714 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 8715 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8716 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8717 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003c0" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 8718 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 8719 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 8720 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003c0" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 8721 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 8722 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 8723 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 0, "id": 8724 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 8725 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x000003c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8726 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "Timings" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8727 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "updatecheck_succeeded_ms" }, { "name": "Data", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc9!\\x00\\x00\\x00\\x00\\x00\\x00#\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings\\updatecheck_succeeded_ms" } ], "repeated": 0, "id": 8728 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "updatecheck_succeeded_ms" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96'\\x00\\x00\\x00\\x00\\x00\\x00#\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings\\updatecheck_succeeded_ms" } ], "repeated": 0, "id": 8729 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "Counts" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x0000075c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8730 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "worker_update_check_succeeded" }, { "name": "Data", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_succeeded" } ], "repeated": 0, "id": 8731 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "worker_update_check_succeeded" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_succeeded" } ], "repeated": 0, "id": 8732 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "worker_update_check_total" }, { "name": "Data", "value": "\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_total" } ], "repeated": 0, "id": 8733 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "worker_update_check_total" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_total" } ], "repeated": 0, "id": 8734 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "Booleans" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x00000768" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8735 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" }, { "name": "ValueName", "value": "worker_is_uac_disabled" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x01\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_uac_disabled" } ], "repeated": 0, "id": 8736 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" }, { "name": "ValueName", "value": "worker_is_windows_installing" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_windows_installing" } ], "repeated": 0, "id": 8737 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003c0" }, { "name": "SubKey", "value": "Integers" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x00000770" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 8738 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" }, { "name": "ValueName", "value": "worker_shell_version" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x03\\x00\\xe9\\x00\\x03\\x00\\x01\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\worker_shell_version" } ], "repeated": 0, "id": 8739 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" }, { "name": "ValueName", "value": "omaha_version" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x03\\x00\\xe9\\x00\\x03\\x00\\x01\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\omaha_version" } ], "repeated": 0, "id": 8740 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" }, { "name": "ValueName", "value": "is_system_install" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x01\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\is_system_install" } ], "repeated": 0, "id": 8741 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "goopdate_main" }, { "name": "Data", "value": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main" } ], "repeated": 0, "id": 8742 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "goopdate_main" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "R\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main" } ], "repeated": 0, "id": 8743 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "goopdate_constructor" }, { "name": "Data", "value": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor" } ], "repeated": 0, "id": 8744 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "goopdate_constructor" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "R\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor" } ], "repeated": 0, "id": 8745 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" }, { "name": "ValueName", "value": "windows_major_version" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\windows_major_version" } ], "repeated": 0, "id": 8746 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "opt_in_uid_generated" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\opt_in_uid_generated" } ], "repeated": 0, "id": 8747 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" }, { "name": "ValueName", "value": "opt_in_uid_generated" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\opt_in_uid_generated" } ], "repeated": 0, "id": 8748 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" }, { "name": "ValueName", "value": "last_checked" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "$n\\x19j\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\last_checked" } ], "repeated": 0, "id": 8749 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000075c" } ], "repeated": 0, "id": 8750 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 8751 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000770" } ], "repeated": 0, "id": 8752 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000768" } ], "repeated": 0, "id": 8753 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 8754 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b0" } ], "repeated": 1, "id": 8755 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "shutdown", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1648" }, { "name": "how", "value": "1" } ], "repeated": 0, "id": 8756 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "closesocket", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1648" } ], "repeated": 0, "id": 8757 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x6a9ee87f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000738" } ], "repeated": 0, "id": 8758 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060e2000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8759 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06107000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8760 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0297f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8761 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000072c" } ], "repeated": 0, "id": 8762 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000730" } ], "repeated": 0, "id": 8763 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060e2000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8764 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xf0Q\\x02,\\x17\\x00\\x00\\x00\\x17\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5888" } ], "repeated": 0, "id": 8765 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xf0Q\\x02,\\x17\\x00\\x00\\x00\\x17\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5888" } ], "repeated": 0, "id": 8766 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000560" } ], "repeated": 0, "id": 8767 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 8768 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 8769 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x76723803", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056c" } ], "repeated": 0, "id": 8770 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 8771 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x766efc08", "parentcaller": "0x766efabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ac" } ], "repeated": 0, "id": 8772 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8773 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x777d2586", "parentcaller": "0x777d1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 8774 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x7539bb8b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" } ], "repeated": 0, "id": 8775 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x7539bb9c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000530" } ], "repeated": 0, "id": 8776 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774a040b", "parentcaller": "0x7539bbab", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052c" } ], "repeated": 0, "id": 8777 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8778 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x7536273f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 8779 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10416", "caller": "0x774aab1a", "parentcaller": "0x75362629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005fc" } ], "repeated": 0, "id": 8780 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10484", "caller": "0x774aab1a", "parentcaller": "0x75398afe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 8781 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "10484", "caller": "0x774c906b", "parentcaller": "0x774c900f", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 8782 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\n\\x00\\x00\\x00\\x00\\x00\\x8e\\x91\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8783 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\\x91\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8784 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\n\\x00\\x00\\x00\\x00\\x00\\x8e\\x91\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8785 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000318" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\\x91\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 8786 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8787 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 8788 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "synchronization", "api": "NtReleaseMutant", "status": false, "return": "0xffffffffc0000046", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8789 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 8790 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8791 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777f9a30" } ], "repeated": 0, "id": 8792 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8793 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 8794 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774d03f0" } ], "repeated": 1, "id": 8795 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate" }, { "name": "DllBase", "value": "0x6aeb0000" } ], "repeated": 0, "id": 8796 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x70670000" } ], "repeated": 0, "id": 8797 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 8798 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 8799 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8800 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8801 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x6ec40000" } ], "repeated": 0, "id": 8802 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x6ebd0000" } ], "repeated": 0, "id": 8803 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8804 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8805 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ebd0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8806 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 8807 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x741d0000" } ], "repeated": 0, "id": 8808 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8809 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8810 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8811 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8812 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8813 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ec40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8814 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8815 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8816 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70670000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8817 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VERSION" }, { "name": "DllBase", "value": "0x75460000" } ], "repeated": 0, "id": 8818 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8819 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8820 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75460000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8821 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x75450000" } ], "repeated": 0, "id": 8822 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 8823 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 8824 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x6ae60000" } ], "repeated": 0, "id": 8825 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8826 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8827 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ae60000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8828 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8829 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8830 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75450000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8831 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETUTILS" }, { "name": "DllBase", "value": "0x74890000" } ], "repeated": 0, "id": 8832 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8833 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8834 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74890000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8835 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 8836 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 8837 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WKSCLI" }, { "name": "DllBase", "value": "0x748a0000" } ], "repeated": 0, "id": 8838 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8839 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8840 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x748a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8841 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8842 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8843 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aeb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 8844 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x74950000" } ], "repeated": 0, "id": 8845 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74950000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8846 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x00161cf7", "parentcaller": "0x00161d44", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x74950000" }, { "name": "FunctionName", "value": "AppPolicyGetProcessTerminationMethod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74953a40" } ], "repeated": 0, "id": 8847 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015ecf2", "parentcaller": "0x0015ec89", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0xfffffffa" } ], "repeated": 0, "id": 8848 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 8849 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 8850 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0297f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8851 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060e1000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8852 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x029a9000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8853 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0297d000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8854 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8855 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0298b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8856 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028e6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 8857 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 8858 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 8859 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e0" } ], "repeated": 0, "id": 8860 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e4" } ], "repeated": 0, "id": 8861 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006e8" } ], "repeated": 0, "id": 8862 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006ec" } ], "repeated": 0, "id": 8863 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006f0" } ], "repeated": 0, "id": 8864 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006f4" } ], "repeated": 0, "id": 8865 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006dc" } ], "repeated": 0, "id": 8866 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006c0" } ], "repeated": 0, "id": 8867 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d8" } ], "repeated": 0, "id": 8868 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006c4" } ], "repeated": 0, "id": 8869 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006cc" } ], "repeated": 0, "id": 8870 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006c8" } ], "repeated": 0, "id": 8871 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000620" } ], "repeated": 0, "id": 8872 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000006d4" } ], "repeated": 0, "id": 8873 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000678" } ], "repeated": 0, "id": 8874 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000680" } ], "repeated": 0, "id": 8875 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8876 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8877 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000674" } ], "repeated": 0, "id": 8878 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000618" } ], "repeated": 0, "id": 8879 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000668" } ], "repeated": 0, "id": 8880 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000664" } ], "repeated": 0, "id": 8881 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000660" } ], "repeated": 0, "id": 8882 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000063c" } ], "repeated": 0, "id": 8883 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000638" } ], "repeated": 0, "id": 8884 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000634" } ], "repeated": 0, "id": 8885 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000630" } ], "repeated": 0, "id": 8886 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" } ], "repeated": 0, "id": 8887 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" } ], "repeated": 0, "id": 8888 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 8889 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000540" } ], "repeated": 0, "id": 8890 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 8891 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05f60000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8892 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 8893 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8894 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8895 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 8896 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aadd000" }, { "name": "ModuleName", "value": "Windows.Storage.Search.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8897 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aadd000" }, { "name": "ModuleName", "value": "Windows.Storage.Search.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8898 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8899 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8900 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 8901 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 8902 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 8903 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 8904 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "NtUpdateWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x778148a0" } ], "repeated": 0, "id": 8905 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 8906 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 8907 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8908 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8909 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a611c", "parentcaller": "0x755ab346", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 8910 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a611c", "parentcaller": "0x0015ec93", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 8911 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a611c", "parentcaller": "0x755ab304", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 8912 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a6946", "parentcaller": "0x755a812a", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" }, { "name": "MutexName", "value": "Local\\SM0:5932:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 8913 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a704e", "parentcaller": "0x755a4a7e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 8914 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x755a9b3e", "parentcaller": "0x755a812a", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 1, "id": 8915 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774d03f0" } ], "repeated": 1, "id": 8916 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 8917 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x026f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8918 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 8919 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 8920 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 8921 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 8922 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8923 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8924 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 8925 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02600000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8926 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 8927 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04c60000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 8928 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 8929 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 8930 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 8931 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 8932 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 8933 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 8934 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 8935 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 8936 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 8937 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 8938 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 8939 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 8940 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 8941 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 8942 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 8943 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 8944 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8945 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8946 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 8947 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 8948 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 8949 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000098" } ], "repeated": 0, "id": 8950 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" } ], "repeated": 0, "id": 8951 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e4" } ], "repeated": 0, "id": 8952 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001dc" } ], "repeated": 0, "id": 8953 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 8954 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c8" } ], "repeated": 0, "id": 8955 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 8956 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 8957 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d4" } ], "repeated": 0, "id": 8958 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d8" } ], "repeated": 0, "id": 8959 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x757e2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8960 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x757e2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8961 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 8962 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 8963 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 8964 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 8965 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 8966 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 8967 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 8968 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 8969 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 8970 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 8971 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 8972 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 8973 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 8974 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 8975 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 8976 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 8977 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 8978 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 8979 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 8980 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 8981 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 8982 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 8983 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 8984 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 8985 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 8986 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 8987 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" } ], "repeated": 0, "id": 8988 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 8989 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 8990 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 8991 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 8992 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 8993 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 8994 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 8995 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 8996 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 8997 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000013c" } ], "repeated": 0, "id": 8998 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 8999 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 9000 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 9001 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 9002 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 9003 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 9004 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 9005 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 9006 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000f8" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 9007 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 9008 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 9009 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000f8" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 9010 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 9011 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 9012 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 9013 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d4" } ], "repeated": 0, "id": 9014 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 9015 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 9016 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 9017 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 9018 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 9019 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 9020 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 9021 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b0" } ], "repeated": 0, "id": 9022 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 9023 }, { "timestamp": "2026-05-29 10:44:53,284", "thread_id": "5888", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 9024 } ], "threads": [ "9680", "2628", "8292", "3276", "9284", "5888", "10244", "10256", "10272", "10276", "10280", "10312", "10332", "10340", "10356", "10416", "10484" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00150000", "MainExeSize": "0x00035000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 11132, "process_name": "MicrosoftEdgeUpdate.exe", "parent_id": 5932, "module_path": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "first_seen": "2026-05-29 10:44:52,753", "calls": [ { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x7784c270", "parentcaller": "0x77806601", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11236", "caller": "0x777f1b7e", "parentcaller": "0x777edb21", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000088" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11248", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11248", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11244", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11244", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11240", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11240", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11236", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11236", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015d98e", "parentcaller": "0x0015da16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015d98e", "parentcaller": "0x0015da16", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77390000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015da26", "parentcaller": "0x0015db41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774c7c30" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015d98e", "parentcaller": "0x0015da16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015d98e", "parentcaller": "0x0015da16", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77390000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015da26", "parentcaller": "0x0015da52", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774cd2c0" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015da26", "parentcaller": "0x0015db03", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsSetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774b5030" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77390000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161e83", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774c7c30" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77390000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161d84", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774cd2c0" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161e02", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsGetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774ac970" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161e41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsSetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774b5030" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00160004", "parentcaller": "0x00160f86", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030e5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00160d76", "parentcaller": "0x0015f3cd", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x030c4408", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00160d81", "parentcaller": "0x0015f3cd", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x030c1b18", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x77390000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161bc0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774a2280" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x00160004", "parentcaller": "0x0015e7a4", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030e6000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015fde0", "parentcaller": "0x00160f1b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030e8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015bef3", "parentcaller": "0x0015b77e", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x0015bf00" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015accc", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015acd3", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "SetDefaultDllDirectories" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775643a0" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015acee", "parentcaller": "0x0015b7fa", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x030c1b18", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015af22", "parentcaller": "0x0015aece", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015af38", "parentcaller": "0x0015aece", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "AcquireSRWLockExclusive" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777e2380" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015af4d", "parentcaller": "0x0015aece", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "ReleaseSRWLockExclusive" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777e2520" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:44:52,799", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015aeff", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b28a", "parentcaller": "0x0015aece", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHELL32.dll" }, { "name": "BaseAddress", "value": "0x768c0000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b358", "parentcaller": "0x0015aece", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x768c0000" }, { "name": "FunctionName", "value": "SHGetKnownFolderPath" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76a29e90" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015b141", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11136" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "windows.storage.dll" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000054" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\windows.storage.dll" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00613000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75005000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75005000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75005000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "Wldp.dll" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000054" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000054" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\wldp.dll" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a30000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00024000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a4f000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a4d000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a4d000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a4d000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75005000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030e9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe0C\\x0c\\x03\\x80+\\x00\\x00\\x02\\x00\\x00\\x00\\xc0C\r\\x03\\xe4+\\x00\\x00\\x02\\x00\\x00\\x00PD\r\\x03\\xe8+\\x00\\x00\\x02\\x00\\x00\\x00 D\r\\x03\\xec+\\x00\\x00\\x02\\x00\\x00\\x00\\xf0C\r\\x03\\xf0+\\x00\\x00" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74a4d000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x74a30000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x74a60000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-eventing-provider-l1-1-0.dll" }, { "name": "ModuleHandle", "value": "0x77390000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "EventSetInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d0b00" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\wldp" }, { "name": "BaseAddress", "value": "0x74a30000" }, { "name": "InitRoutine", "value": "0x74a38960" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x77390000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77804f20" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775675c0" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7780a680" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7500b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\windows.storage" }, { "name": "BaseAddress", "value": "0x74a60000" }, { "name": "InitRoutine", "value": "0x74c3cdc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e17000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e17000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x75f00000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00158f71", "parentcaller": "0x001597c8", "category": "filesystem", "api": "SHGetKnownFolderPath", "status": true, "return": "0x00000000", "arguments": [ { "name": "FolderID", "value": "905E63B6-C1BF-494E-B29C-65B732D3D21A" }, { "name": "Flags", "value": "0x00000000" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015c825", "parentcaller": "0x00158d5c", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015c825", "parentcaller": "0x00158d5c", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 1, "id": 96 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015c825", "parentcaller": "0x00158d5c", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015c825", "parentcaller": "0x00158d5c", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\msedgeupdate.dll" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015aeff", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b28a", "parentcaller": "0x0015ae9f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x75e50000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b358", "parentcaller": "0x0015ae9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ebe0" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015b141", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159a31", "parentcaller": "0x0015941d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000284" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015aeff", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b358", "parentcaller": "0x0015ae9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6eb10" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015b141", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159a83", "parentcaller": "0x0015941d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159ab6", "parentcaller": "0x0015941d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" }, { "name": "ValueName", "value": "pv" }, { "name": "Data", "value": "1.3.233.3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015aeff", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b358", "parentcaller": "0x0015ae9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed50" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015b104", "parentcaller": "0x0015b141", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0016a000" }, { "name": "ModuleName", "value": "MicrosoftEdgeUpdate.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159aff", "parentcaller": "0x0015941d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x0015c825", "parentcaller": "0x00158d5c", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate.dll" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x70670000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VERSION" }, { "name": "DllBase", "value": "0x75460000" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x75450000" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETUTILS" }, { "name": "DllBase", "value": "0x74890000" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WKSCLI" }, { "name": "DllBase", "value": "0x748a0000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate" }, { "name": "DllBase", "value": "0x6aeb0000" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x75f90000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x77390000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHLWAPI.dll" }, { "name": "BaseAddress", "value": "0x76180000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x75f90000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate.dll" }, { "name": "BaseAddress", "value": "0x6aeb0000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159820", "parentcaller": "0x0015ad16", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x6aeb0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x00159876", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "ModuleHandle", "value": "0x6aeb0000" }, { "name": "FunctionName", "value": "DllEntry" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6aeb7330" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "PathAppendW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76195ec0" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "AddDllDirectory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77562670" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel32.dll" }, { "name": "BaseAddress", "value": "0x75f90000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75f90000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\kernel32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fa9580" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03ad0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 145 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03ae0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "PathRemoveFileSpecW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76194fb0" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHELL32.dll" }, { "name": "BaseAddress", "value": "0x768c0000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x768c0000" }, { "name": "FunctionName", "value": "SHGetFolderPathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76a1dd20" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x0000401c", "pretty_value": "CSIDL_FLAG_DONT_VERIFY|CSIDL_LOCAL_APPDATA" }, { "name": "Path", "value": "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00004026", "pretty_value": "CSIDL_FLAG_DONT_VERIFY|CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x75e50000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ebe0" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel32.dll" }, { "name": "BaseAddress", "value": "0x75f90000" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75f90000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\kernel32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "GetProductInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb2310" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfo" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-ProductInfoLegacyMapping" }, { "name": "Type", "value": "0x00000003" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PIPE\\wkssvc" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "`\\x00\\x00\\x00\\x90\\xd0\\x0c\\x03" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 181 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\Rpc" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "Buffer", "value": "\\x05\\x00\\x0b\\x03\\x10\\x00\\x00\\x00t\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xb8\\x10\\xb8\\x10\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x98\\xd0\\xffk\\x12\\xa1\\x106\\x983F\\xc3\\xf8~4Z\\x01\\x00\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x01\\x00\\x01\\x00\\x98\\xd0\\xffk\\x12\\xa1\\x106\\x983F\\xc3\\xf8~4Z\\x01\\x00\\x00\\x00,\\x1c\\xb7l\\x12\\x98@E\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00" }, { "name": "Length", "value": "116" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "Buffer", "value": "\\x05\\x00\\x0c\\x03\\x10\\x00\\x00\\x00\\\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xb8\\x10\\xb8\\x10\\x8b\\x0c\\x00\\x00\r\\x00\\PIPE\\wkssvc\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x03\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "92" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021d" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 187 }, { "timestamp": "2026-05-29 10:44:52,815", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x6ebd0000" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MDMRegistration" }, { "name": "DllBase", "value": "0x6a970000" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\MDMRegistration.dll" }, { "name": "BaseAddress", "value": "0x6a970000" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x6a970000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\MDMRegistration.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MDMRegistration.dll" }, { "name": "ModuleHandle", "value": "0x6a970000" }, { "name": "FunctionName", "value": "IsDeviceRegisteredWithManagement" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6a991e20" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "omadmapi.dll" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\omadmapi.dll" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\omadmapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\omadmapi.dll" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754b0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0002c000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754d7000" }, { "name": "ModuleName", "value": "omadmapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754d5000" }, { "name": "ModuleName", "value": "omadmapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754d5000" }, { "name": "ModuleName", "value": "omadmapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754d5000" }, { "name": "ModuleName", "value": "omadmapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "powrprof.dll" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CRYPTSP.dll" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "DMCmnUtils.dll" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\powrprof.dll" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\powrprof.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\powrprof.dll" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00044000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b8000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b6000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b6000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b6000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\cryptsp.dll" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\cryptsp.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\cryptsp.dll" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00013000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741e0000" }, { "name": "ModuleName", "value": "CRYPTSP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741df000" }, { "name": "ModuleName", "value": "CRYPTSP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741df000" }, { "name": "ModuleName", "value": "CRYPTSP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741df000" }, { "name": "ModuleName", "value": "CRYPTSP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\DMCmnUtils.dll" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\DMCmnUtils.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\dmcmnutils.dll" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a900000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00063000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a95c000" }, { "name": "ModuleName", "value": "DMCmnUtils.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a959000" }, { "name": "ModuleName", "value": "DMCmnUtils.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a959000" }, { "name": "ModuleName", "value": "DMCmnUtils.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a959000" }, { "name": "ModuleName", "value": "DMCmnUtils.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ncrypt.dll" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "tbs.dll" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b6000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741df000" }, { "name": "ModuleName", "value": "CRYPTSP.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754d5000" }, { "name": "ModuleName", "value": "omadmapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00w\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00O\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00d\\x00m\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00i\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ncrypt.dll" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ncrypt.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\ncrypt.dll" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00021000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1b000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1a000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1a000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1a000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\tbs.dll" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\tbs.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\tbs.dll" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00013000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8ef000" }, { "name": "ModuleName", "value": "tbs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8ef000" }, { "name": "ModuleName", "value": "tbs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8ef000" }, { "name": "ModuleName", "value": "tbs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "imagehlp.dll" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00019000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a4000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a3000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a3000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a3000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1a000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a959000" }, { "name": "ModuleName", "value": "DMCmnUtils.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00w\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00E\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x00M\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00i\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a3000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8ef000" }, { "name": "ModuleName", "value": "tbs.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x6f2a0000" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x741d0000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x70d00000" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x76790000" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x6a8e0000" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x6a900000" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x754b0000" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "UMPDC.dll" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\umpdc.dll" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\umpdc.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\umpdc.dll" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f290000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f29b000" }, { "name": "ModuleName", "value": "UMPDC.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f29a000" }, { "name": "ModuleName", "value": "UMPDC.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f29a000" }, { "name": "ModuleName", "value": "UMPDC.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f29a000" }, { "name": "ModuleName", "value": "UMPDC.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f29a000" }, { "name": "ModuleName", "value": "UMPDC.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:44:52,831", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x6f290000" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\umpdc" }, { "name": "BaseAddress", "value": "0x6f290000" }, { "name": "InitRoutine", "value": "0x6f297560" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b8000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2b8000" }, { "name": "ModuleName", "value": "powrprof.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x6f2b5801", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\powrprof" }, { "name": "BaseAddress", "value": "0x6f2a0000" }, { "name": "InitRoutine", "value": "0x6f2a6ed0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cryptsp" }, { "name": "BaseAddress", "value": "0x741d0000" }, { "name": "InitRoutine", "value": "0x741d5d30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "NTASN1.dll" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntasn1.dll" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntasn1.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d0" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\ntasn1.dll" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70200000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00028000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70224000" }, { "name": "ModuleName", "value": "NTASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70224000" }, { "name": "ModuleName", "value": "NTASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70224000" }, { "name": "ModuleName", "value": "NTASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70224000" }, { "name": "ModuleName", "value": "NTASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x70200000" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntasn1" }, { "name": "BaseAddress", "value": "0x70200000" }, { "name": "InitRoutine", "value": "0x70215950" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1b000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d1b000" }, { "name": "ModuleName", "value": "ncrypt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ncrypt" }, { "name": "BaseAddress", "value": "0x70d00000" }, { "name": "InitRoutine", "value": "0x70d08730" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a5000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "GetThreadContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fc38b0" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "GetThreadTimes" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb2210" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "IsProcessorFeaturePresent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb0e10" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "OpenThread" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75faf850" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "ProcessIdToSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb0e30" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "SetProcessShutdownParameters" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fa9540" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "SetThreadContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fc4d00" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "GetProcessId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb0ec0" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a5000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a5000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x767a5000" }, { "name": "ModuleName", "value": "imagehlp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\imagehlp" }, { "name": "BaseAddress", "value": "0x76790000" }, { "name": "InitRoutine", "value": "0x76796560" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\tbs" }, { "name": "BaseAddress", "value": "0x6a8e0000" }, { "name": "InitRoutine", "value": "0x6a8e4790" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x77390000" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77804f20" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775675c0" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7780a680" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "EtwEventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ce100" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "EtwEventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777f9a30" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "EtwEventEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77806b30" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "EtwEventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77801320" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03104000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03105000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03107000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03109000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dmcmnutils" }, { "name": "BaseAddress", "value": "0x6a900000" }, { "name": "InitRoutine", "value": "0x6a94b9a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\omadmapi" }, { "name": "BaseAddress", "value": "0x754b0000" }, { "name": "InitRoutine", "value": "0x754d0050" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a9bd000" }, { "name": "ModuleName", "value": "MDMRegistration.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a9bd000" }, { "name": "ModuleName", "value": "MDMRegistration.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "MutexName", "value": "__OMADM_NAMED_MUTEX__" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "Milliseconds", "value": "60000" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 373 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Provisioning\\OMADM\\Accounts" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Provisioning\\OMADM\\Accounts" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f0" }, { "name": "KeyInformation", "value": "rvH\\xffd5\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 377 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Provisioning\\OMADM\\Accounts" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Provisioning\\OMADM\\Accounts" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 1, "id": 379 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03111000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a9bd000" }, { "name": "ModuleName", "value": "MDMRegistration.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a9bd000" }, { "name": "ModuleName", "value": "MDMRegistration.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MDMRegistration" }, { "name": "DllBase", "value": "0x6a970000" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x754b0000" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x6ebd0000" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ebd0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x6f2a0000" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x6f290000" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f290000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f2a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x6a900000" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x741d0000" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x70d00000" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x70200000" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70200000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70d00000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x6a8e0000" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x76790000" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a8e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a900000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6a970000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\netapi32.dll" }, { "name": "BaseAddress", "value": "0x70670000" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x70670000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\NetApi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x6ebd0000" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x741d0000" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x6ec40000" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetGetAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6ecce210" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 456 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ed24000" }, { "name": "ModuleName", "value": "DSREG.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ed24000" }, { "name": "ModuleName", "value": "DSREG.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 460 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "ValueName", "value": "DiagLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "ValueName", "value": "DiagMatchAnyMask" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 465 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 467 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000294" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000294" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "CertDllOpenStoreProv" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b8" }, { "name": "ObjectAttributesName", "value": "#16" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "KeyInformation", "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b8" }, { "name": "ObjectAttributesName", "value": "Ldap" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "KeyInformation", "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ec" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "EncodingType 1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "CertDllOpenStoreProv" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 501 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 503 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 506 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 510 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "CRLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CRLs" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 513 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "CTLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CTLs" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 516 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xf3\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xf3\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\xe7\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x003\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00`\\xf3\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xd8\\xf3\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xb1\\xe7\\xa5\\xe0\\x0c\\xef\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff$\\xf4\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbjd\\xf4\\xcf\\x02\\xcc\\xf6\\x84\\xf4$\\xf4\\x14\\xf4\\x88\\xf4\\x00\\x00\\xdc\\x07\\x00\\x00\\xcc\\xf6\\xcf\\x02\\x84\\xf4\\xcf\\x02\\x88\\xf4\\xcf\\x02\\x00\\x00\\x00\\x008\\xf4\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00d\\xf4\\xcf\\x02" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER" }, { "name": "ObjectAttributes", "value": "HKEY_USERS" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002a8" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xf3\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xf3\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\xe7\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x003\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00`\\xf3\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xd8\\xf3\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xb1\\xe7\\xa5\\xe0\\x0c\\xef\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff$\\xf4\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbjd\\xf4\\xcf\\x02\\xcc\\xf6\\x84\\xf4$\\xf4\\x14\\xf4\\x88\\xf4\\x00\\x00\\xdc\\x07\\x00\\x00\\xcc\\xf6\\xcf\\x02\\x84\\xf4\\xcf\\x02\\x88\\xf4\\xcf\\x02\\x00\\x00\\x00\\x008\\xf4\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00d\\xf4\\xcf\\x02" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 550 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "profapi.dll" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\profapi.dll" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0001c000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74199000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74197000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74197000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74197000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74197000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\profapi" }, { "name": "DllBase", "value": "0x74180000" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\profapi" }, { "name": "BaseAddress", "value": "0x74180000" }, { "name": "InitRoutine", "value": "0x7418a840" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76173000" }, { "name": "ModuleName", "value": "CRYPT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b8" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\x07\\x10\\x03\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74199000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74199000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 583 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbe\\x91\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002a8" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\n\\x0e\\x02\\x02`\\xf2\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\xe6\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x000\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00(\\xf2\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xa0\\xf2\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xe9\\xe6\\xa5\\xe0\\xd4\\xed\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\xec\\xf2\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj,\\xf3\\xcf\\x02\\x94\\xf5L\\xf3\\xec\\xf2\\xdc\\xf2P\\xf3\\x00\\x00\\xdc\\x07\\x00\\x00\\x94\\xf5\\xcf\\x02L\\xf3\\xcf\\x02P\\xf3\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\xf3\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00,\\xf3\\xcf\\x02" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 597 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030efbd8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef458", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030efa58", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030efb18", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\netapi32.dll" }, { "name": "BaseAddress", "value": "0x70670000" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x70670000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\NetApi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetFreeAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6eccde90" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:44:52,846", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\MicrosoftEdgeUpdate.ini" } ], "repeated": 9, "id": 614 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "AllocateAndInitializeSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f1c0" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "CheckTokenMembership" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f670" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "FreeSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6fda0" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00000023", "pretty_value": "CSIDL_COMMON_APPDATA" }, { "name": "Path", "value": "C:\\ProgramData" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\MicrosoftEdgeUpdate.ini" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ce100" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-eventing-provider-l1-1-0.dll" }, { "name": "ModuleHandle", "value": "0x77390000" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "EventSetInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d0b00" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 637 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSidLengthRequired" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e86000" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "InitializeSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e860c0" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSidSubAuthority" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f160" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "IsValidSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f1a0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetLengthSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed70" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "CopySid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ee80" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "InitializeSecurityDescriptor" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f520" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "InitializeAcl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f400" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "AddAce" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e85190" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetAclInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e85ec0" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "SetSecurityDescriptorDacl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f280" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorControl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e85f40" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorLength" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e736c0" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "MakeSelfRelativeSD" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e86540" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "CreateMutexExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb3230" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "CreateEventExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb31f0" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "MutexName", "value": "_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorOwner" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e74ff0" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorGroup" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e85f60" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorDacl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6f3e0" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetSecurityDescriptorSacl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e74750" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "CreateDisposition", "value": "3", "pretty_value": "FILE_OPEN_IF" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "18", "pretty_value": "FileAllInformation" }, { "name": "FileInformation", "value": "" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xa4N\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4N\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xa4N\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4N\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00C\\x00o\\x00n\\x00f\\x00i\\x00g\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00L\\x00o\\x00a\\x00d\\x00G\\x00r\\x00o\\x00u\\x00p\\x00P\\x00o\\x00l\\x00i\\x00c\\x00i\\x00e\\x00s\\x00]\\x00[\\x00M\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00 \\x00i\\x00s\\x00 \\x00n\\x00o\\x00t\\x00 \\x00E\\x00n\\x00t\\x00e\\x00r\\x00p\\x00r\\x00i\\x00s\\x00e\\x00 \\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00" }, { "name": "Length", "value": "138" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\Copilot" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Copilot" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 720 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xbeO\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xbeO\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xbeO\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xbeO\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00C\\x00o\\x00p\\x00i\\x00l\\x00o\\x00t\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00s\\x00e\\x00t\\x00_\\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00[\\x00C\\x00o\\x00p\\x00i\\x00l\\x00o\\x00t\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00i\\x00s\\x00_\\x00m\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00a\\x00l\\x00l\\x00o\\x00w\\x00_\\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00a\\x00t\\x00i\\x00o\\x00n\\x00]\\x00[\\x000\\x00]\\x00]\\x00" }, { "name": "Length", "value": "178" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 730 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x00Q\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00Q\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x00Q\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00Q\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00O\\x00m\\x00a\\x00h\\x00a\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00:\\x00:\\x00s\\x00e\\x00t\\x00_\\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00G\\x00r\\x00o\\x00u\\x00p\\x00 \\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00[\\x00C\\x00a\\x00c\\x00h\\x00e\\x00d\\x00O\\x00m\\x00a\\x00h\\x00a\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00]\\x00[\\x00i\\x00s\\x00_\\x00i\\x00n\\x00i\\x00t\\x00i\\x00a\\x00l\\x00i\\x00z\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00i\\x00s\\x00_\\x00m\\x00a\\x00n\\x00a\\x00g\\x00e\\x00d\\x00]\\x00[\\x000\\x00]\\x00[\\x00a\\x00u\\x00t\\x00o\\x00_\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x00c\\x00h\\x00e\\x00c\\x00k\\x00_\\x00p\\x00e\\x00r\\x00i\\x00o\\x00d\\x00_\\x00m\\x00i\\x00" }, { "name": "Length", "value": "842" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "GetComputerNameExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "netapi32.dll" }, { "name": "BaseAddress", "value": "0x70670000" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x70670000", "arguments": [ { "name": "lpLibFileName", "value": "netapi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetGetAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6ecce210" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetFreeAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6eccde90" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 745 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 747 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 749 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 752 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002fc" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 756 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "CRLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CRLs" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 759 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "CTLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CTLs" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 762 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000300" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xb0\\xf2\\xcf\\x02\\xe8\\xf2\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\xe6\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x006\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00\\xb0\\xf2\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00(\\xf3\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddja\\xe7\\xa5\\xe0\\\\xee\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xfft\\xf3\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj\\xb4\\xf3\\xcf\\x02\\x1c\\xf6\\xd4\\xf3t\\xf3d\\xf3\\xd8\\xf3\\x00\\x00\\xdc\\x07\\x00\\x00\\x1c\\xf6\\xcf\\x02\\xd4\\xf3\\xcf\\x02\\xd8\\xf3\\xcf\\x02\\x00\\x00\\x00\\x00\\x88\\xf3\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\xb4\\xf3\\xcf\\x02" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 781 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000300" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xf2\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\xe6\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x006\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00\\xb0\\xf2\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00(\\xf3\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddja\\xe7\\xa5\\xe0\\\\xee\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xfft\\xf3\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj\\xb4\\xf3\\xcf\\x02\\x1c\\xf6\\xd4\\xf3t\\xf3d\\xf3\\xd8\\xf3\\x00\\x00\\xdc\\x07\\x00\\x00\\x1c\\xf6\\xcf\\x02\\xd4\\xf3\\xcf\\x02\\xd8\\xf3\\xcf\\x02\\x00\\x00\\x00\\x00\\x88\\xf3\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\xb4\\xf3\\xcf\\x02" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 792 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002fc" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\x07\\x10\\x03\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 805 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xcd\\x92\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000300" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\n\\x0e\\x02\\x02\\xb0\\xf1\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcd\\xe5\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x003\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00x\\xf1\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xf0\\xf1\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\x99\\xe5\\xa5\\xe0$\\xed\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff<\\xf2\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj|\\xf2\\xcf\\x02\\xe4\\xf4\\x9c\\xf2<\\xf2,\\xf2\\xa0\\xf2\\x00\\x00\\xdc\\x07\\x00\\x00\\xe4\\xf4\\xcf\\x02\\x9c\\xf2\\xcf\\x02\\xa0\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00P\\xf2\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00|\\xf2\\xcf\\x02" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 819 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef898", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef9d8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef6d8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef658", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 833 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xdaT\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdaT\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xdaT\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdaT\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00D\\x00l\\x00l\\x00E\\x00n\\x00t\\x00r\\x00y\\x00]\\x00[\\x00\"\\x00C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00.\\x00e\\x00x\\x00e\\x00\"\\x00 \\x00/\\x00p\\x00i\\x00n\\x00g\\x00 \\x00P\\x00D\\x009\\x004\\x00b\\x00W\\x00w\\x00g\\x00d\\x00m\\x00V\\x00y\\x00c\\x002\\x00l\\x00v\\x00b\\x00j\\x000\\x00i\\x00M\\x00S\\x004\\x00w\\x00I\\x00i\\x00B\\x00l\\x00b\\x00m\\x00N\\x00v\\x00Z\\x00G\\x00l\\x00u\\x00Z\\x00z\\x000\\x00i\\x00V\\x00" }, { "name": "Length", "value": "4854" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ec60" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000300" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6e8c0" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xfa\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "EqualSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70500" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 1, "id": 855 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "SHGetFolderPathW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Folder", "value": "0x00000026", "pretty_value": "CSIDL_PROGRAM_FILES" }, { "name": "Path", "value": "C:\\Program Files (x86)" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x75810000" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75810000" }, { "name": "FunctionName", "value": "CharLowerBuffW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7583c220" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "PathCommonPrefixW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x761950b0" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 873 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 874 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00`h\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`h\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00`h\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`h\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x001\\x00.\\x003\\x00.\\x002\\x003\\x003\\x00.\\x003\\x00\\\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00.\\x00d\\x00l\\x00l\\x00]\\x00[\\x00v\\x00e\\x00r\\x00s\\x00i\\x00o\\x00n\\x00 \\x001\\x00.\\x003\\x00.\\x002\\x003\\x003\\x00.\\x003\\x00]\\x00[\\x00o\\x00p\\x00t\\x00]\\x00[\\x00o\\x00f\\x00f\\x00i\\x00c\\x00i\\x00a\\x00l\\x00]\\x00" }, { "name": "Length", "value": "212" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "ModuleHandle", "value": "0x768c0000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76a1a240" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e17000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e17000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x03107860", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f4b80", "arguments": [ { "name": "CommandLine", "value": "prog.exe" }, { "name": "NumArgs", "value": "1" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f1ce8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /c [/nocrashserver" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030dd2b0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /crashhandler" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030e4298", "arguments": [ { "name": "CommandLine", "value": "prog.exe /svc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x03102ee0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /medsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x03102b28", "arguments": [ { "name": "CommandLine", "value": "prog.exe /regsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030ef558", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregsvc" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030ef918", "arguments": [ { "name": "CommandLine", "value": "prog.exe /regserver" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030efbd8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregserver" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x03102d20", "arguments": [ { "name": "CommandLine", "value": "prog.exe /crash" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030ef698", "arguments": [ { "name": "CommandLine", "value": "prog.exe -Embedding" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x031028f8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /broker" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03124000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030efa98", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ondemand" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0310fc30", "arguments": [ { "name": "CommandLine", "value": "prog.exe /install extra [/appargs appargs [/installsource src [/silent [/eularequired [/oem [/installelevated [/sessionid sid [/enterprise" }, { "name": "NumArgs", "value": "14" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x03103a20", "arguments": [ { "name": "CommandLine", "value": "prog.exe /update [/sessionid sid [/selfrepair" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x0310a418", "arguments": [ { "name": "CommandLine", "value": "prog.exe /handoff extra [/appargs appargs [/installsource src [/silent [/eularequired [/offlineinstall [/offlinedir dir [/sessionid sid [/enterprise" }, { "name": "NumArgs", "value": "15" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f0ac0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ua [/installsource source [/machine [/critical" }, { "name": "NumArgs", "value": "6" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f0ac0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /report filename [/machine [/custom_info_filename customfilename" }, { "name": "NumArgs", "value": "6" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030fcae0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /report /i filename [/machine" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030fc380", "arguments": [ { "name": "CommandLine", "value": "prog.exe /recover repairfile" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x031070e8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /recover /machine repairfile" }, { "name": "NumArgs", "value": "4" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030ef558", "arguments": [ { "name": "CommandLine", "value": "prog.exe /uninstall" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f0ac0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /registerproduct extraargs [/installsource source" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x031070e8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /unregisterproduct extraargs" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f1dd8", "arguments": [ { "name": "CommandLine", "value": "prog.exe /ping pingstring" }, { "name": "NumArgs", "value": "3" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030ef918", "arguments": [ { "name": "CommandLine", "value": "prog.exe /healthcheck" }, { "name": "NumArgs", "value": "2" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x030f0ac0", "arguments": [ { "name": "CommandLine", "value": "prog.exe /browserreplacement [/installsource source [/machine" }, { "name": "NumArgs", "value": "5" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 920 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xc4i\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc4i\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xc4i\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc4i\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x008\\x006\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00i\\x00s\\x00 \\x00m\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00:\\x00 \\x001\\x00]\\x00[\\x00C\\x00u\\x00r\\x00r\\x00e\\x00n\\x00t\\x00 \\x00d\\x00i\\x00r\\x00]\\x00[\\x00C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00\\\\x001\\x00.\\x003\\x00.\\x002\\x003\\x003\\x00.\\x003\\x00]\\x00" }, { "name": "Length", "value": "166" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000304" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6eb10" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 10:44:52,862", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed50" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x6b09eb80", "arguments": [ { "name": "Module", "value": "0x6aeb0000" }, { "name": "Type", "value": "#6" }, { "name": "Name", "value": "#188" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "LoadResource", "status": true, "return": "0x6b0d8f38", "arguments": [ { "name": "Module", "value": "0x6aeb0000" }, { "name": "ResourceInfo", "value": "0x6b09eb80" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "LockResource", "status": true, "return": "0x6b0d8f38", "arguments": [ { "name": "ResourceData", "value": "0x6b0d8f38" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x0000004a", "arguments": [ { "name": "ModuleHandle", "value": "0x6aeb0000" }, { "name": "ResourceInfo", "value": "0x6b09eb80" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemDefaultLangID", "status": true, "return": "0x030d0409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x030d0409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ole32.dll" }, { "name": "BaseAddress", "value": "0x75720000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoInitializeEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f27f80" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000308" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74950000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7495c000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74959000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74959000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74959000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74959000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x74950000" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x6ec0b801", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x74950000" }, { "name": "InitRoutine", "value": "0x749547e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75df0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e4a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e4a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e4a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e4a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x75df0000" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000030c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000030c" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000308" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000030c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000030c" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xad\\x98\\x10\\xeaYQK5\\x18\\xe2Y\\xc3\\x1a \\x0bG\\x93\\xd0FpR>\\x9a\\x85#\\xda\\x94\\x81\\x17\\xa6H\\xb3\\x02\\x11\\\\xb8\\xcc\\xe4\\x00\\x99\\x8d\\xbdlP\\xd8\\xe5\\xbe7" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x75df0000" }, { "name": "InitRoutine", "value": "0x75e236c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76782000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76782000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03129000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000314" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "SHQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7619d080" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x761c0000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "ValueName", "value": "OemInstallTime" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000314" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "ValueName", "value": "eulaaccepted" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 1012 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\license.rtf" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "OpenThreadToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6eaf0" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000314" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xf8\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000314" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xf8\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "WTSGetActiveConsoleSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb2140" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "WINSTA.dll" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000314" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\winsta.dll" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ae60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00047000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea2000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea0000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea0000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea0000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea0000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x6ae60000" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\winsta" }, { "name": "BaseAddress", "value": "0x6ae60000" }, { "name": "InitRoutine", "value": "0x6ae79300" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000318" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea2000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea2000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x777a0000" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlGetSuiteMask" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777d06d0" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea2000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aea2000" }, { "name": "ModuleName", "value": "WINSTA.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "EventName", "value": "Global\\TermSrvReadyEvent" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 1055 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1056 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1057 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1059 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1061 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0312d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wtsapi32.dll" }, { "name": "BaseAddress", "value": "0x75450000" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75450000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\wtsapi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75450000" }, { "name": "FunctionName", "value": "WTSQueryUserToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75451930" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x02000000" }, { "name": "TokenHandle", "value": "0x00000320" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545c000" }, { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 1074 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "DuplicateTokenEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70360" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "ImpersonateLoggedOnUser" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e70720" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xec\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xb9\\xab\\x7fw\\x08\\xed\\xcf\\x02\\x8b\\xc9Jw\\xa4\\xee\\xcf\\x02\\xc2q~w\\xab\\x8c~w\\xb7,_\\xd8\\x00\\x00\\x0c\\x03\\xa6\\x06\\x00\\x00@\\xef\\xcf\\x02\\xa6\\x06\\x00\\x00" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000320" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xe1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00<\\xe2\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\xd0G\\xbdjA\\xf6\\xa5\\xe0\\\\x92\\xe9\\x03XW\\xddj\\x94\\xe2\\xcf\\x02J\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "ValueBuffer", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sList" }, { "name": "ValueBuffer", "value": "," }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sList" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sDecimal" }, { "name": "ValueBuffer", "value": "." }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sDecimal" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sThousand" }, { "name": "ValueBuffer", "value": "," }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sThousand" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sGrouping" }, { "name": "ValueBuffer", "value": "3;0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sGrouping" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sNativeDigits" }, { "name": "ValueBuffer", "value": "0123456789" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNativeDigits" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sMonDecimalSep" }, { "name": "ValueBuffer", "value": "." }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonDecimalSep" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sMonThousandSep" }, { "name": "ValueBuffer", "value": "," }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonThousandSep" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sMonGrouping" }, { "name": "ValueBuffer", "value": "3;0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonGrouping" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sPositiveSign" }, { "name": "ValueBuffer", "value": "" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sPositiveSign" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sNegativeSign" }, { "name": "ValueBuffer", "value": "-" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNegativeSign" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sTimeFormat" }, { "name": "ValueBuffer", "value": "h:mm:ss tt" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sTimeFormat" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sShortTime" }, { "name": "ValueBuffer", "value": "h:mm tt" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortTime" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "s1159" }, { "name": "ValueBuffer", "value": "AM" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s1159" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "s2359" }, { "name": "ValueBuffer", "value": "PM" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s2359" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sShortDate" }, { "name": "ValueBuffer", "value": "d/MM/yyyy" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortDate" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sYearMonth" }, { "name": "ValueBuffer", "value": "MMMM yyyy" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sYearMonth" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sLongDate" }, { "name": "ValueBuffer", "value": "dddd, d MMMM yyyy" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sLongDate" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iCountry" }, { "name": "ValueBuffer", "value": "61" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCountry" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iMeasure" }, { "name": "ValueBuffer", "value": "0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iMeasure" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iPaperSize" }, { "name": "ValueBuffer", "value": "9" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iPaperSize" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iDigits" }, { "name": "ValueBuffer", "value": "2" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iDigits" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iLZero" }, { "name": "ValueBuffer", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iLZero" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iNegNumber" }, { "name": "ValueBuffer", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegNumber" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "NumShape" }, { "name": "ValueBuffer", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\NumShape" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iCurrDigits" }, { "name": "ValueBuffer", "value": "2" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrDigits" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iCurrency" }, { "name": "ValueBuffer", "value": "0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrency" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iNegCurr" }, { "name": "ValueBuffer", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegCurr" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iFirstDayOfWeek" }, { "name": "ValueBuffer", "value": "0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstDayOfWeek" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryMultipleValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iFirstWeekOfYear" }, { "name": "ValueBuffer", "value": "0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstWeekOfYear" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "sCurrency" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "$" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sCurrency" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "iCalendarType" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCalendarType" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000320" }, { "name": "ObjectAttributesName", "value": "\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "ValueName", "value": "Currencies" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "ValueName", "value": "Calendar" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Gregorian" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Gregorian" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Gregorian" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0312f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000073c", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegGetValueA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e86820" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1140 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "BuildLabEx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "19041.1.amd64fre.vb_release.191206-1406" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx" } ], "repeated": 1, "id": 1142 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlGetVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777cff50" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlConvertDeviceFamilyInfoToString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77854fd0" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1156 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "ValueName", "value": "CommercialId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\CommercialId" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Iphlpapi" }, { "name": "DllBase", "value": "0x73fa0000" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Iphlpapi.dll" }, { "name": "BaseAddress", "value": "0x73fa0000" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Iphlpapi.dll" }, { "name": "ModuleHandle", "value": "0x73fa0000" }, { "name": "FunctionName", "value": "GetAdaptersInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73fa4950" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x76290000" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x73f80000" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "GetAdaptersInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1167 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "ValueName", "value": "SystemManufacturer" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "ASUS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ], "repeated": 1, "id": 1169 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1171 }, { "timestamp": "2026-05-29 10:44:52,878", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "ValueName", "value": "SystemProductName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PRIME B450M-A II" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName" } ], "repeated": 1, "id": 1173 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "device", "api": "NtPowerInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "InformationLevel", "value": "5" }, { "name": "InputBuffer", "value": "" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoCreateGuid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f21e00" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000330" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x6b014860" }, { "name": "Parameter", "value": "0x030e91a0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "8548" }, { "name": "ProcessId", "value": "11132" }, { "name": "Module", "value": "msedgeupdate.dll" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "CreateThread", "status": true, "return": "0x00000330", "arguments": [ { "name": "StartRoutine", "value": "0x6b014860" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "Parameter", "value": "0x030e91a0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8548" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlGetVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777cff50" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "8548", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "8548", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "8548", "caller": "0x774aa206", "parentcaller": "0x6b00275a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x74950000" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "8548", "caller": "0x774aa206", "parentcaller": "0x6b00275a", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74950000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "8548", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x74950000" }, { "name": "FunctionName", "value": "AppPolicyGetThreadInitializationType" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74953a60" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\diagnosticdataquery" }, { "name": "DllBase", "value": "0x73e90000" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "diagnosticdataquery.dll" }, { "name": "BaseAddress", "value": "0x73e90000" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x73e90000", "arguments": [ { "name": "lpLibFileName", "value": "diagnosticdataquery.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "diagnosticdataquery.dll" }, { "name": "ModuleHandle", "value": "0x73e90000" }, { "name": "FunctionName", "value": "UtcSendTraceLogging2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e956d0" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000334" }, { "name": "ValueName", "value": "MachineId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 1, "id": 1193 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000334" }, { "name": "ValueName", "value": "MachineId" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "IIDFromString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76eef5f0" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f594c0" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x76650000" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x6f0b0000" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\msxml6.dll" }, { "name": "BaseAddress", "value": "0x6f0b0000" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "88D96A05-F192-11D4-A65F-0040963251E5" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "2933BF81-7B36-11D2-B20E-00C04F983E60" }, { "name": "ProgID", "value": "Msxml2.DOMDocument.6.0" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "OLEAUT32.dll" }, { "name": "BaseAddress", "value": "0x76810000" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "15" }, { "name": "FunctionAddress", "value": "0x768288b0" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7689d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7689d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "21" }, { "name": "FunctionAddress", "value": "0x76826330" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "20" }, { "name": "FunctionAddress", "value": "0x76825220" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "19" }, { "name": "FunctionAddress", "value": "0x76823d90" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "22" }, { "name": "FunctionAddress", "value": "0x76826300" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "40" }, { "name": "FunctionAddress", "value": "0x768284a0" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03134000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "27" }, { "name": "FunctionAddress", "value": "0x7682a2d0" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "77" }, { "name": "FunctionAddress", "value": "0x76826050" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f24d000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f24d000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03135000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae5000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aea000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aeb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aec000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aed000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aee000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aef000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05af0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05af1000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05af6000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "9" }, { "name": "FunctionAddress", "value": "0x7682e9e0" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "16" }, { "name": "FunctionAddress", "value": "0x7682d1b0" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "2" }, { "name": "FunctionAddress", "value": "0x7682fa70" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "314" }, { "name": "FunctionAddress", "value": "0x76825160" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00t\\xf1\\xcf\\x02\\xf8\\xf6\\xf0\\x03\\xa0\\xe7}ws\\xb7\\x0c\\x03F\\x02\\x00\\x00\\xf8\\xf6\\xf0\\x03s\\xb7\\x0c\\x03\\xa0\\xe7}w4\\x00\\x00\\xc0@\\xf6\\xcf\\x02F\\x02\\x00\\x00" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000370" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000374" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "6" }, { "name": "FunctionAddress", "value": "0x7682ec30" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "8" }, { "name": "FunctionAddress", "value": "0x76823d70" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "149" }, { "name": "FunctionAddress", "value": "0x76826520" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "150" }, { "name": "FunctionAddress", "value": "0x7682f620" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "7" }, { "name": "FunctionAddress", "value": "0x76823f50" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess" }, { "name": "Handle", "value": "0x00000364" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000364" }, { "name": "ValueName", "value": "ActivePolicyCode" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000364" }, { "name": "ValueName", "value": "ActivePolicyCode" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x777d062d", "parentcaller": "0x777d011b", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netprofm" }, { "name": "DllBase", "value": "0x73eb0000" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\netprofm.dll" }, { "name": "BaseAddress", "value": "0x73eb0000" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x73eb65da", "parentcaller": "0x73eb6491", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x6af26a3b", "parentcaller": "0x6af26b17", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DCB00C01-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "DCB00000-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1300 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "System\\Setup" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\Setup" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000398" }, { "name": "ValueName", "value": "SystemSetupInProgress" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 10:44:52,893", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x7749ecfa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774c98d7", "parentcaller": "0x75fb11d7", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000003c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x76fac5b0" }, { "name": "Parameter", "value": "0x0312fe78" }, { "name": "CreateFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6408" }, { "name": "ProcessId", "value": "11132" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "6408", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "6408", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "7024", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03141000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "7024", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "7024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "7024", "caller": "0x774b9924", "parentcaller": "0x766ec2f8", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000368" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x766eeacc", "parentcaller": "0x766eea60", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "7024", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03144000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x76fa8344", "parentcaller": "0x777d105f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x76f61477", "parentcaller": "0x76f68b43", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x73ea0000" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x76f410d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\npmproxy.dll" }, { "name": "BaseAddress", "value": "0x73ea0000" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x73ec0f66", "parentcaller": "0x73eb478f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03147000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03148000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x766eeacc", "parentcaller": "0x766eea60", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774b9924", "parentcaller": "0x76f6ee83", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000003dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774adb61", "parentcaller": "0x73ec4cc9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774b1b7a", "parentcaller": "0x73ec4d0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "NtQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77812f00" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x73ec4d29", "parentcaller": "0x73eb818d", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "134" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774b1c1d", "parentcaller": "0x75faf804", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "CoUninitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f27fd0" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774c7efa", "parentcaller": "0x6b010f4e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x774a917f", "parentcaller": "0x76f26a20", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11172", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x770c7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x88\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x88\\x00\\x00\\x00\\xd0\\x07\\xab\\x03\\xc8\\xe6\\xf0\\x03\\x00\\xe9\\xf0\\x03\\x00\\x00\\x00\\x00L\\x00\\x00\\x00&\\x00\\x00\\x00\\x03+\\xffj\\xde\\xae\\x10\\x03\\x98r\\x10\\x03L\\x00\\x00\\x00" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003e0" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e0" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "consentcommunicated" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\consentcommunicated" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\usagestats" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "urlstats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\urlstats" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\optedintoinsider" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "previousedgepreviewvalue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\previousedgepreviewvalue" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "edgepreviewdisenrollreason" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\edgepreviewdisenrollreason" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1356 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xfaj\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfaj\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xfaj\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfaj\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x000\\x009\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00a\\x00p\\x00p\\x00_\\x00r\\x00e\\x00g\\x00i\\x00s\\x00t\\x00r\\x00y\\x00_\\x00u\\x00t\\x00i\\x00l\\x00s\\x00:\\x00:\\x00A\\x00r\\x00e\\x00A\\x00p\\x00p\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00s\\x00A\\x00l\\x00l\\x00o\\x00w\\x00e\\x00d\\x00F\\x00o\\x00r\\x00M\\x00e\\x00t\\x00e\\x00r\\x00e\\x00d\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00s\\x00]\\x00[\\x00C\\x00h\\x00e\\x00c\\x00k\\x00i\\x00n\\x00g\\x00 \\x00f\\x00o\\x00r\\x00 \\x00a\\x00p\\x00p\\x00 \\x00{\\x00F\\x003\\x00C\\x004\\x00F\\x00E\\x000\\x000\\x00-\\x00E\\x00F\\x00D\\x005\\x00-\\x004\\x000\\x003\\x00B\\x00-\\x009\\x005\\x006\\x009\\x00-\\x003\\x009\\x008\\x00A\\x002\\x000\\x00F\\x001\\x00B\\x00A\\x004\\x00A\\x00}\\x00]\\x00" }, { "name": "Length", "value": "234" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x75720000" }, { "name": "FunctionName", "value": "StringFromGUID2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f21c40" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75810000" }, { "name": "FunctionName", "value": "CharUpperW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75850110" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "AllowAutoWindowsUpdateDownloadOverMeteredNetwork" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\AllowAutoWindowsUpdateDownloadOverMeteredNetwork" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "consentcommunicated" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\consentcommunicated" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "urlstats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\urlstats" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\optedintoinsider" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "previousedgepreviewvalue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\previousedgepreviewvalue" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "edgepreviewdisenrollreason" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\edgepreviewdisenrollreason" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1397 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00tl\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "tl\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00tl\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "tl\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x000\\x009\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00a\\x00p\\x00p\\x00_\\x00r\\x00e\\x00g\\x00i\\x00s\\x00t\\x00r\\x00y\\x00_\\x00u\\x00t\\x00i\\x00l\\x00s\\x00:\\x00:\\x00A\\x00r\\x00e\\x00A\\x00p\\x00p\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00s\\x00A\\x00l\\x00l\\x00o\\x00w\\x00e\\x00d\\x00F\\x00o\\x00r\\x00M\\x00e\\x00t\\x00e\\x00r\\x00e\\x00d\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00s\\x00]\\x00[\\x00C\\x00h\\x00e\\x00c\\x00k\\x00i\\x00n\\x00g\\x00 \\x00f\\x00o\\x00r\\x00 \\x00a\\x00p\\x00p\\x00 \\x00{\\x005\\x006\\x00E\\x00B\\x001\\x008\\x00F\\x008\\x00-\\x00B\\x000\\x000\\x008\\x00-\\x004\\x00C\\x00B\\x00D\\x00-\\x00B\\x006\\x00D\\x002\\x00-\\x008\\x00C\\x009\\x007\\x00F\\x00E\\x007\\x00E\\x009\\x000\\x006\\x002\\x00}\\x00]\\x00" }, { "name": "Length", "value": "234" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "allowautoupdatesmetered" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\allowautoupdatesmetered" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "AllowAutoWindowsUpdateDownloadOverMeteredNetwork" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\AllowAutoWindowsUpdateDownloadOverMeteredNetwork" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "consentcommunicated" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\consentcommunicated" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "urlstats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\urlstats" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "optedintoinsider" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\optedintoinsider" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "previousedgepreviewvalue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\previousedgepreviewvalue" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "edgepreviewdisenrollreason" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\edgepreviewdisenrollreason" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1433 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xeem\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xeem\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\xeem\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xeem\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 10:44:52,909", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x000\\x009\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00a\\x00p\\x00p\\x00_\\x00r\\x00e\\x00g\\x00i\\x00s\\x00t\\x00r\\x00y\\x00_\\x00u\\x00t\\x00i\\x00l\\x00s\\x00:\\x00:\\x00A\\x00r\\x00e\\x00A\\x00p\\x00p\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00s\\x00A\\x00l\\x00l\\x00o\\x00w\\x00e\\x00d\\x00F\\x00o\\x00r\\x00M\\x00e\\x00t\\x00e\\x00r\\x00e\\x00d\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00s\\x00]\\x00[\\x00C\\x00h\\x00e\\x00c\\x00k\\x00i\\x00n\\x00g\\x00 \\x00f\\x00o\\x00r\\x00 \\x00a\\x00p\\x00p\\x00 \\x00{\\x00F\\x003\\x000\\x001\\x007\\x002\\x002\\x006\\x00-\\x00F\\x00E\\x002\\x00A\\x00-\\x004\\x002\\x009\\x005\\x00-\\x008\\x00B\\x00D\\x00F\\x00-\\x000\\x000\\x00C\\x003\\x00A\\x009\\x00A\\x007\\x00E\\x004\\x00C\\x005\\x00}\\x00]\\x00" }, { "name": "Length", "value": "234" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "allowautoupdatesmetered" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\allowautoupdatesmetered" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings" }, { "name": "Handle", "value": "0x000003e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003e4" }, { "name": "ValueName", "value": "AllowAutoWindowsUpdateDownloadOverMeteredNetwork" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\AllowAutoWindowsUpdateDownloadOverMeteredNetwork" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03150000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03153000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 1452 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03156000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 1456 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 1458 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RevertToSelf" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6fa10" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000324" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "ValueName", "value": "MachineId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 1, "id": 1464 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "ValueName", "value": "MachineId" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76180000" }, { "name": "FunctionName", "value": "UrlEscapeA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7619b1f0" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "netapi32.dll" }, { "name": "BaseAddress", "value": "0x70670000" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x70670000", "arguments": [ { "name": "lpLibFileName", "value": "netapi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetGetAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6ecce210" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "NETAPI32.dll" }, { "name": "ModuleHandle", "value": "0x70670000" }, { "name": "FunctionName", "value": "NetFreeAadJoinInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x6eccde90" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1474 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1476 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1478 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1481 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000324" }, { "name": "ObjectAttributesName", "value": "" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "Certificates" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 1485 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "CRLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CRLs" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 1488 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "CTLs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CTLs" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003d4" }, { "name": "KeyInformation", "value": "\\xffcb\\x1e(\\xffc6\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 1, "id": 1491 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d4" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003cc" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00P\\xf1\\xcf\\x02\\x88\\xf1\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\xe5\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x003\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00P\\xf1\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xc8\\xf1\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xc1\\xe5\\xa5\\xe0\\xfc\\xec\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\x14\\xf2\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbjT\\xf2\\xcf\\x02\\xbc\\xf4t\\xf2\\x14\\xf2\\x04\\xf2x\\xf2\\x00\\x00\\xdc\\x07\\x00\\x00\\xbc\\xf4\\xcf\\x02t\\xf2\\xcf\\x02x\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00(\\xf2\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00T\\xf2\\xcf\\x02" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1510 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003cc" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xf1\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf5\\xe5\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x003\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00P\\xf1\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\xc8\\xf1\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xc1\\xe5\\xa5\\xe0\\xfc\\xec\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\x14\\xf2\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbjT\\xf2\\xcf\\x02\\xbc\\xf4t\\xf2\\x14\\xf2\\x04\\xf2x\\xf2\\x00\\x00\\xdc\\x07\\x00\\x00\\xbc\\xf4\\xcf\\x02t\\xf2\\xcf\\x02x\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00(\\xf2\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00T\\xf2\\xcf\\x02" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1521 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000324" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98a\\x14\\x03\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1534 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000324" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "%systemroot%\\system32\\config\\systemprofile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "q\\x95\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003cc" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xef\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\n\\x0e\\x02\\x02P\\xf0\\xcf\\x02d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\xe4\\xa5\\xe0\\xa9\\x98\\x15\\x00\\x00\\x00\\x00\\x00c\\xad\\x15\\x000\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xd0\\x02\\x00\\x00\\x00\\x00\\x18\\xf0\\xcf\\x02\\xc4\\xfc\\xcf\\x02\\x00\\xfd\\xcf\\x02\\xa9\\x98\\x15\\x00\\xc8K\\xddjc\\xad\\x15\\x00\\x90\\xf0\\xcf\\x02\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\\\x92\\xe9\\x03\\xc8K\\xddj\\xf9\\xe4\\xa5\\xe0\\xc4\\xeb\\xcf\\x02\\xec\\xa8\\xb9j\\x00\\xfd\\xcf\\x02\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\xdc\\xf0\\xcf\\x02\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj\\x1c\\xf1\\xcf\\x02\\x84\\xf3<\\xf1\\xdc\\xf0\\xcc\\xf0@\\xf1\\x00\\x00\\xdc\\x07\\x00\\x00\\x84\\xf3\\xcf\\x02<\\xf1\\xcf\\x02@\\xf1\\xcf\\x02\\x00\\x00\\x00\\x00\\xf0\\xf0\\xcf\\x024\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\x1c\\xf1\\xcf\\x02" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1548 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\My" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003cc" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03156000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03149000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03153000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef618", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030efa98", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030efa98", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030ef458", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc1daa923" }, { "name": "FirstCreateTimeHigh", "value": "0x01dceef0" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1567 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00ho\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "ho\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00ho\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "ho\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x002\\x005\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00E\\x00C\\x00S\\x00A\\x00r\\x00g\\x00s\\x00A\\x00d\\x00d\\x00U\\x00s\\x00e\\x00r\\x00O\\x00I\\x00D\\x00:\\x00 \\x00N\\x00o\\x00t\\x00 \\x00s\\x00e\\x00n\\x00d\\x00i\\x00n\\x00g\\x00 \\x00u\\x00s\\x00e\\x00r\\x00i\\x00d\\x00 \\x00-\\x00 \\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00 \\x00i\\x00s\\x00 \\x00n\\x00o\\x00t\\x00 \\x00i\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00 \\x00A\\x00A\\x00D\\x00 \\x00j\\x00o\\x00i\\x00n\\x00e\\x00d\\x00]\\x00" }, { "name": "Length", "value": "150" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03153000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003cc" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xf8\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003cc" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "ConvertSidToStringSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6e6f0" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\winhttp" }, { "name": "DllBase", "value": "0x75340000" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\winhttp" }, { "name": "BaseAddress", "value": "0x75340000" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75340000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\winhttp" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpAddRequestHeaders" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7534f610" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpCheckPlatform" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7538fbc0" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75366700" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpConnect" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75367830" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpCrackUrl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7536d980" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpCreateUrl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7536d320" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpDetectAutoProxyConfigUrl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x753b7a80" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpGetIEProxyConfigForCurrentUser" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7537de80" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpGetDefaultProxyConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7536f630" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpGetProxyForUrl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75368bd0" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpOpen" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75362d50" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpOpenRequest" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75350600" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpQueryAuthSchemes" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x753b9580" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpQueryDataAvailable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75368ed0" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpQueryHeaders" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75363000" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpQueryOption" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75351f70" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpReadData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x753787e0" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpReceiveResponse" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75353720" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSendRequest" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75368620" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSetDefaultProxyConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x753b8630" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSetCredentials" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x753b9730" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSetOption" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75364570" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSetStatusCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75364850" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpSetTimeouts" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75358030" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "ModuleHandle", "value": "0x75340000" }, { "name": "FunctionName", "value": "WinHttpWriteData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75388840" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "winhttp.dll" }, { "name": "BaseAddress", "value": "0x75340000" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper" }, { "name": "DllBase", "value": "0x6e3b0000" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll" }, { "name": "BaseAddress", "value": "0x6e3b0000" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper" }, { "name": "DllBase", "value": "0x6e3b0000" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11172", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00000010", "pretty_value": "KEY_NOTIFY" }, { "name": "ObjectAttributesHandle", "value": "0x00000408" }, { "name": "ObjectAttributesName", "value": "TenantRestrictions\\Payload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpOpen", "status": true, "return": "0x03133c18", "arguments": [ { "name": "UserAgent", "value": "" }, { "name": "ProxyName", "value": "" }, { "name": "ProxyBypass", "value": "" }, { "name": "AccessType", "value": "0x00000001" }, { "name": "Flags", "value": "0x10000000" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 1620 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1621 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11172", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11172", "caller": "0x7748b853", "parentcaller": "0x774ee66a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "KeyInformation", "value": ";#\\x05x]&\\xffda\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x7539bc7b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "SetSecurityDescriptorOwner" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6fd80" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "SetSecurityDescriptorGroup" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e74830" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "old-uid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "old-uid" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{FF7E44AB-182C-4237-80DB-F58260993716}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "uid-create-time" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1780051491" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "uid-num-rotations" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 1, "id": 1647 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "LastECSETag" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "\"Z4YNAWPMOlHJbvgX3eb6sgxxvBAjTfZLbRpNgdduL+o=\"" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 1665 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03156000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000042c" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xf7\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000042c" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xf7\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x75f90000" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75f90000" }, { "name": "FunctionName", "value": "WTSGetActiveConsoleSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75fb2140" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000042c" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "12" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 1682 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1684 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1686 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1688 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1690 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wtsapi32.dll" }, { "name": "BaseAddress", "value": "0x75450000" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75450000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\wtsapi32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WTSAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75450000" }, { "name": "FunctionName", "value": "WTSQueryUserToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75451930" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x02000000" }, { "name": "TokenHandle", "value": "0x0000042c" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 1697 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xf2\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00@\\xf3\\x01\\x01\\x00\\x00\\x00\\x00\\xc0\\x00\\xb1\\x03F\\x00\\x00F \\x00\\x00\\x00\\x15\\x00\\x00\\x00h\\xf3\\xcf\\x02L\\xa1\\xef\\x03`\\xf3\\xcf\\x02\\xbfb~w\\x05\\x00\\x00\\x00" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000420" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000420" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\" }, { "name": "Handle", "value": "0x00000430" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "ECSExpiryConfig" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ECSExpiryConfig" } ], "repeated": 1, "id": 1708 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000430" }, { "name": "ValueName", "value": "ECSExpiryConfig" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.233.3?clientId=s:088B0758-31C5-47D8-9C4B-32E98EB1AB80&appBrandCode_webview=EUWV&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivi" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ECSExpiryConfig" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpOpen", "status": true, "return": "0x03156ac8", "arguments": [ { "name": "UserAgent", "value": "" }, { "name": "ProxyName", "value": "" }, { "name": "ProxyBypass", "value": "" }, { "name": "AccessType", "value": "0x00000001" }, { "name": "Flags", "value": "0x10000000" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 1, "id": 1717 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 1, "id": 1718 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x6bc10000" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegOpenCurrentUser" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e706e0" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "x\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 %~w\\x00\\x00\\x00\\x00\\xb4\\xf6\\xcf\\x02\\xb1\\x0f\\x01k\\x94\\xa7\tk\\xe0\\x06\\xe7u\\x90\\x0f\\x01k\\x04\\x00\\x00\\x00\\xfc\\xf6\\xcf\\x02$\\x12\\x01k\\x19\\x00\\x02\\x00" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000444" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xf0\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf8\\xc7\\xf0\\x03;\\x00\\x00\\x00\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x13\\x00\\x000\\x85\\xf0\\x03\\x1d\\x00\\x07\\x00@\\xa9\\xef\\x03\\x00\\x00\\x00\\x00\\xa8\\xf1\\x01\\x01" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000444" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEXPLORE.EXE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "x\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00X\\xf7\\xcf\\x02\\xb8\\xf6\\xcf\\x02\\x1e^~w\\x08\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0n\\xebjd\\xac\tk\\xcc\\xf6\\xcf\\x02\\xc1n\\xebj" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000444" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xf0\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf8\\xc7\\xf0\\x03;\\x00\\x00\\x00\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x13\\x00\\x000\\x85\\xf0\\x03\\x1d\\x00\t\\x00@\\xa9\\xef\\x03\\x00\\x00\\x00\\x00\\xa8\\xf1\\x01\\x01" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000444" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEXPLORE.EXE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:44:52,924", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "x\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00X\\xf7\\xcf\\x02\\xb8\\xf6\\xcf\\x02\\x1e^~w\\x08\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0n\\xebjd\\xac\tk\\xcc\\xf6\\xcf\\x02\\xc1n\\xebj" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000454" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xf0\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf8\\xc7\\xf0\\x03;\\x00\\x00\\x00\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x13\\x00\\x000\\x85\\xf0\\x03\\x1d\\x00\\x19\\x00@\\xa9\\xef\\x03\\x00\\x00\\x00\\x00\\xa8\\xf1\\x01\\x01" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEXPLORE.EXE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(\\xf6\\xcf\\x02`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1779 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections" }, { "name": "Class", "value": "" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "WinHttpSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xf7\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\t\\x00\\x0f\\x00\\xf0\\x0c\\x0f\\x030\\x13\\x0f\\x03\\x00\\x18\\x0f\\x03\\x00\\x00\\x0c\\x03\\x00\\x00\\x00\\x00`\\xf7\\xcf\\x02V<~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegCreateKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ee60" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000438" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\proxy" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x00000454" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\proxy" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "source" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "ValueName", "value": "source" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEWPAD" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpGetIEProxyConfigForCurrentUser", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00(\\xf7\\xcf\\x02\\x88\\xf6\\xcf\\x02\\x1e^~w\\x08\\x00\\x00\\x00\\x1e^~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0n\\xebjd\\xac\tk\\x9c\\xf6\\xcf\\x02\\xc1n\\xebj" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000458" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xf0\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf8\\xc7\\xf0\\x03;\\x00\\x00\\x00\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x13\\x00\\x000\\x85\\xf0\\x03\\x1d\\x00\\x02\\x00@\\xa9\\xef\\x03\\x00\\x00\\x00\\x00x\\xf1\\x01\\x01" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "Control Panel\\International" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "LocaleName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Clients\\StartMenuInternet" }, { "name": "Handle", "value": "0x00000438" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000438" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEXPLORE.EXE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1814 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x8ep\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8ep\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x8ep\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8ep\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x004\\x000\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00d\\x00e\\x00t\\x00e\\x00c\\x00t\\x00e\\x00d\\x00 \\x00c\\x00o\\x00n\\x00f\\x00i\\x00g\\x00u\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00]\\x00[\\x00\r\\x00\n\\x00p\\x00r\\x00i\\x00o\\x00r\\x00i\\x00t\\x00y\\x00=\\x002\\x00,\\x00 \\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00I\\x00E\\x00W\\x00P\\x00A\\x00D\\x00,\\x00 \\x00w\\x00p\\x00a\\x00d\\x00=\\x001\\x00,\\x00 \\x00s\\x00c\\x00r\\x00i\\x00p\\x00t\\x00=\\x00\r\\x00\n\\x00p\\x00r\\x00i\\x00o\\x00r\\x00i\\x00t\\x00y\\x00=\\x000\\x00,\\x00 \\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00d\\x00i\\x00r\\x00e\\x00c\\x00t\\x00,\\x00 \\x00d\\x00i\\x00r\\x00e\\x00c\\x00t\\x00 \\x00c\\x00o\\x00n\\x00n\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00\r\\x00\n\\x00]\\x00" }, { "name": "Length", "value": "238" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1824 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x0cr\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0cr\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\\x0cr\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0cr\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x004\\x000\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00S\\x00e\\x00n\\x00d\\x00]\\x00[\\x00u\\x00r\\x00l\\x00=\\x00h\\x00t\\x00t\\x00p\\x00s\\x00:\\x00/\\x00/\\x00c\\x00o\\x00n\\x00f\\x00i\\x00g\\x00.\\x00e\\x00d\\x00g\\x00e\\x00.\\x00s\\x00k\\x00y\\x00p\\x00e\\x00.\\x00c\\x00o\\x00m\\x00/\\x00c\\x00o\\x00n\\x00f\\x00i\\x00g\\x00/\\x00v\\x001\\x00/\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00/\\x001\\x00.\\x003\\x00.\\x002\\x003\\x003\\x00.\\x003\\x00?\\x00c\\x00l\\x00i\\x00e\\x00n\\x00t\\x00I\\x00d\\x00=\\x00s\\x00:\\x000\\x008\\x008\\x00B\\x000\\x007\\x005\\x008\\x00-\\x003\\x001\\x00C\\x005\\x00-\\x004\\x007\\x00D\\x008\\x00-\\x009\\x00C\\x004\\x00B\\x00-\\x003\\x002\\x00E\\x009\\x008\\x00E\\x00B\\x001\\x00A\\x00B\\x008\\x000\\x00&\\x00a\\x00p\\x00p\\x00B\\x00r\\x00a\\x00n\\x00d\\x00" }, { "name": "Length", "value": "4704" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1834 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xfc\\x84\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfc\\x84\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xfc\\x84\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xfc\\x84\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x004\\x000\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00T\\x00r\\x00y\\x00i\\x00n\\x00g\\x00 \\x00c\\x00o\\x00n\\x00f\\x00i\\x00g\\x00:\\x00 \\x00p\\x00r\\x00i\\x00o\\x00r\\x00i\\x00t\\x00y\\x00=\\x002\\x00,\\x00 \\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00=\\x00I\\x00E\\x00W\\x00P\\x00A\\x00D\\x00,\\x00 \\x00w\\x00p\\x00a\\x00d\\x00=\\x001\\x00,\\x00 \\x00s\\x00c\\x00r\\x00i\\x00p\\x00t\\x00=\\x00]\\x00" }, { "name": "Length", "value": "118" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 1844 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\x02\\x86\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x86\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\x02\\x86\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x86\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x002\\x00.\\x009\\x004\\x000\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00T\\x00r\\x00y\\x00i\\x00n\\x00g\\x00 \\x00r\\x00e\\x00q\\x00u\\x00e\\x00s\\x00t\\x00 \\x00t\\x00y\\x00p\\x00e\\x00:\\x00 \\x00w\\x00i\\x00n\\x00h\\x00t\\x00t\\x00p\\x00]\\x00" }, { "name": "Length", "value": "60" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpConnect", "status": true, "return": "0x03126560", "arguments": [ { "name": "SessionHandle", "value": "0x03133c18" }, { "name": "ServerName", "value": "config.edge.skype.com" }, { "name": "ServerPort", "value": "443" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpOpenRequest", "status": true, "return": "0x03124018", "arguments": [ { "name": "InternetHandle", "value": "0x03126560" }, { "name": "Verb", "value": "GET" }, { "name": "ObjectName", "value": "/config/v1/EdgeUpdate/1.3.233.3?clientId=s:088B0758-31C5-47D8-9C4B-32E98EB1AB80&appBrandCode_edgeupdate=INBX&appBrandCode_stable=INBX&appBrandCode_webview=EUWV&appChannel_edgeupdate=6&appChannel_stable=4&appChannel_webview=5&appCohort_edgeupdate=rrf@0.45&appCohort_stable=rrf@0.99&appCohort_webview=rrf@0.53&appConsentState_edgeupdate=0&appConsentState_stable=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_stable=0&appDayOfInstall_webview=7084&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_stable=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_stable=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_stable=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_stable=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_stable=1&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_stable=13424525062565861&appLastLaunchTimeJson_stable=2026-05-29t10:44:22.565z&appLastLaunchTimeDaysAgo_stable=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_stable=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_stable=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.233.3&appVersion_stable=148.0.3967.83&appVersion_webview=148.0.3967.83&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=6&hwPhysmemory=8&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=ASUS&oemProductName=PRIME%20B450M-A%20II&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.3803&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.233.3&requestOmahaVersion=1.3.233.3" }, { "name": "Version", "value": "" }, { "name": "Referrer", "value": "" }, { "name": "Flags", "value": "0x00800100" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpSetOption", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" }, { "name": "Option", "value": "0x0000002d" }, { "name": "Buffer", "value": "hq\\x15\\x03" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xf4\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x7537ed9e", "parentcaller": "0x75363e84", "category": "services", "api": "OpenSCManagerW", "status": true, "return": "0x0312f810", "arguments": [ { "name": "MachineName", "value": "" }, { "name": "DatabaseName", "value": "" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "SC_MANAGER_CONNECT" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x7537edb9", "parentcaller": "0x75363e84", "category": "services", "api": "OpenServiceW", "status": true, "return": "0x0312fae0", "arguments": [ { "name": "ServiceControlManager", "value": "0x0312f810" }, { "name": "ServiceName", "value": "WinHttpAutoProxySvc" }, { "name": "DesiredAccess", "value": "0x00000094", "pretty_value": "SERVICE_QUERY_STATUS|SERVICE_START|SERVICE_INTERROGATE" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774ab088", "parentcaller": "0x77726ff4", "category": "threading", "api": "NtOpenThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00100010", "pretty_value": "THREAD_SET_CONTEXT|0x00100000" }, { "name": "ProcessId", "value": "11132" }, { "name": "ThreadId", "value": "18446744073507438608" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777268c8", "parentcaller": "0x777ff0fa", "category": "threading", "api": "NtQueueApcThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessId", "value": "11132" }, { "name": "ThreadId", "value": "11172" }, { "name": "ThreadHandle", "value": "0x00000474" }, { "name": "ApcRoutine", "value": "0x77732550" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aac59", "parentcaller": "0x77727f8c", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aac59", "parentcaller": "0x77727f8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774c906b", "parentcaller": "0x77727fa8", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "250" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x77732570", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x766efc08", "parentcaller": "0x766efabd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x7537ecf3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x7537ed3c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774a9e76", "parentcaller": "0x767266f9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "5\\x96\\x18\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x76726712", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 1, "id": 1881 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x766f0f20", "parentcaller": "0x766ee30f", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aac59", "parentcaller": "0x7535cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x75360659", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x75360659", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x75360659", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x7672439f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x753a50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000440" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpGetProxyForUrl", "status": false, "return": "0x00000000", "arguments": [ { "name": "SessionHandle", "value": "0x03156ac8" }, { "name": "Url", "value": "https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.233.3?clientId=s:088B0758-31C5-47D8-9C4B-32E98EB1AB80&appBrandCode_edgeupdate=INBX&appBrandCode_stable=INBX&appBrandCode_webview=EUWV&appChannel_edgeupdate=6&appChannel_stable=4&appChannel_webview=5&appCohort_edgeupdate=rrf@0.45&appCohort_stable=rrf@0.99&appCohort_webview=rrf@0.53&appConsentState_edgeupdate=0&appConsentState_stable=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_stable=0&appDayOfInstall_webview=7084&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_stable=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_stable=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_stable=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_stable=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_stable=1&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_stable=13424525062565861&appLastLaunchTimeJson_stable=2026-05-29t10:44:22.565z&appLastLaunchTimeDaysAgo_stable=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_stable=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_stable=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.233.3&appVersion_stable=148.0.3967.83&appVersion_webview=148.0.3967.83&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=6&hwPhysmemory=8&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=ASUS&oemProductName=PRIME%20B450M-A%20II&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.3803&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.233.3&requestOmahaVersion=1.3.233.3" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\webio" }, { "name": "DllBase", "value": "0x6a9d0000" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mswsock" }, { "name": "DllBase", "value": "0x6e350000" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" }, { "name": "BaseAddress", "value": "0x6e350000" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINNSI" }, { "name": "DllBase", "value": "0x6e2f0000" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpSendRequest", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" }, { "name": "Headers", "value": "" }, { "name": "Optional", "value": "" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aac59", "parentcaller": "0x7535cb7a", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d1f90", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x753a5097", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x75362629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x753a50ec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "7024", "caller": "0x777d2586", "parentcaller": "0x777d6986", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03178000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 10:44:52,940", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x762aab4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mswsock.dll" }, { "name": "BaseAddress", "value": "0x6e350000" } ], "repeated": 1, "id": 1910 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x762a5580", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x702c0000" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774aa206", "parentcaller": "0x762a5580", "category": "network", "api": "GetAddrInfoExW", "status": false, "return": "0x000003e5", "arguments": [ { "name": "Name", "value": "config.edge.skype.com" }, { "name": "ServiceName", "value": "" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1913 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "7024", "caller": "0x774ac134", "parentcaller": "0x762a92fe", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000500" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x762a9339", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f94e", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 2, "id": 1917 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1919 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f094", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "ValueName", "value": "WinSock_Registry_Version" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "2.0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f94e", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\DNS" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "QueryAdapterName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11284", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DisableAdapterDomainName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UseDomainNameDevolution" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "7024", "caller": "0x774aa206", "parentcaller": "0x774ae5e6", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\rasadhlp" }, { "name": "DllBase", "value": "0x6d030000" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DomainNameDevolutionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "PrioritizeRecordData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "PrioritizeRecordData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "AllowUnqualifiedQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "AllowUnqualifiedQuery" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "AppendToMultiLabelName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ScreenBadTlds" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ScreenUnreachableServers" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ScreenDefaultServers" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DynamicServerQueryOrder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "FilterClusterIp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "WaitForNameErrorOnAll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UseEdns" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DnsSecureNameQueryFallback" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "EnableDAForAllNetworks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DirectAccessQueryOrder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "QueryIpMatching" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UseHostsFile" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "AddrConfigControl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableSmartNameResolution" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "PreferLocalOverLowerBindingDNS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "QueryNetBTFQDN" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableSmartProtocolReordering" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UdpRecvBufferSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableParallelAandAAAA" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableCoalescing" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "FilterVPNTrigger" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "EnableMultiHomedRouteConflicts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ForceQueriesOverTcp" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ShareTcpConnections" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegistrationEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DisableDynamicUpdate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegisterPrimaryName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegisterAdapterName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "EnableAdapterDomainNameRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegisterReverseLookup" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DisableReverseAddressRegistrations" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegisterWanAdapters" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DisableWanDynamicUpdate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegistrationTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DefaultRegistrationTTL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegistrationRefreshInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DefaultRegistrationRefreshInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegistrationMaxAddressCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "MaxNumberOfAddressesToRegister" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UpdateSecurityLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "UpdateSecurityLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UpdateTopLevelDomainZones" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DowncaseSpnCauseApiOwnerIsTooLazy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "RegistrationOverwrite" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MaxCacheSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MaxCacheTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MaxNegativeCacheTtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "AdapterTimeoutLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ServerPriorityTimeLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MaxCachedSockets" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableServerUnreachability" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "EnableMulticast" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MulticastResponderFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MulticastSenderFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "MulticastSenderMaxTimeout" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "EnableMDNS" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DnsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UseCompartments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "CacheAllCompartments" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "UseNewRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ResolverRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ResolverRegistrationOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "NewDhcpSrvRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DirectAccessPreferLocal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableIdnEncoding" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "EnableIdnMapping" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ShortnameProxyDefault" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DisableNRPTForAdapterRegistration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "TestMode_AdaptiveTimeoutHistoryLength" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "TestMode_AdaptiveTimeoutRecalculationInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DnsQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DnsQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "DnsQuickQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "DnsQuickQueryTimeouts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2010 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2012 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2014 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "Hostname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "Hostname" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2020 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2022 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2024 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2026 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\System\\DNSClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "Domain" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "ValueName", "value": "Domain" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749d638", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2032 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef320", "parentcaller": "0x7749d6dd", "category": "registry", "api": "NtCreateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" }, { "name": "Class", "value": "Class" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2034 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2036 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "Hostname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f4" }, { "name": "ValueName", "value": "Hostname" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb166", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774a040b", "parentcaller": "0x702eb175", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x76291941", "parentcaller": "0x73fa70b3", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "\\Device\\Nsi" }, { "name": "IoControlCode", "value": "0x00120007" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b\\xfas\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xf0\\xcd\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b\\xfas\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xf0\\xcd\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x10\\xf0\\xcd\\x05\\xb3p\\xfas\\x01\\x00\\x00\\x000\\x1b\\xfas\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x76291966", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777efecf", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70340000" }, { "name": "ModuleName", "value": "DNSAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777eff04", "parentcaller": "0x777efdc4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70340000" }, { "name": "ModuleName", "value": "DNSAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x766f12f8", "parentcaller": "0x766eea12", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004f4" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x8f\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf4\\xce\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0D\\x13\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00m\\x00p\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x0c\\x03" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xac\\xbe\\x16\\x03\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd4\\xb3\\x14\\x03\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\xd0\\xb3\\x14\\x03\\x00\\x00#\\x00<\\xea0\\xea\\xf4\\x04\\x00\\x00\\x9c\\xf6\\x00\\x00\\x00\\x00\\x0c\\x03#\\x00\\x00\\xc0\\xf4\\x04\\x00\\x00\\x84\\xea\\xcd\\x05\\xb3\\x91\\x7fw\\xf4\\x04\\x00\\x00" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3jt\\x9d\\xf0\\x03\\x9c\\xf6\\xea\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\x91\\xfd\\xa7\\xe7,\\xe5\\xcd\\x05\\xf4\\x04\\x00\\x00|\\xef\\xcd\\x05\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff<\\xea\\xcd\\x05\\x96\\x19\\xbdjE\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x8f\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb4\\xd2\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8E\\x13\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00o\\x00l\\x00\\\\x00L\\x00R\\x00P\\x00C\\x00-\\x00c\\x001\\x004\\x003\\x00a\\x005\\x003\\x00d\\x00c\\x008\\x009\\x00d\\x00c\\x00d\\x00d\\x00c\\x00d\\x000\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xec\\xc0\\x16\\x03\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\\\xad\\x14\\x03\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00X\\xad\\x14\\x03\\x00\\x00#\\x00$\\xe8\\x18\\xe8\\xf4\\x04\\x00\\x00\\x9c\\xf6\\x00\\x00\\x00\\x00\\x0c\\x03#\\x00\\x00\\xc0\\xf4\\x04\\x00\\x00l\\xe8\\xcd\\x05\\xb3\\x91\\x7fw\\xf4\\x04\\x00\\x00" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3jt\\x9d\\xf0\\x03\\x9c\\xf6\\xea\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xa9\\xf3\\xa7\\xe7\\x14\\xe3\\xcd\\x05\\xf4\\x04\\x00\\x00|\\xef\\xcd\\x05\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff$\\xe8\\xcd\\x05\\x96\\x19\\xbdjE\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x766f13d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x766f13f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x77807bb9", "parentcaller": "0x766f22d7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x766f12f8", "parentcaller": "0x766f624d", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000004f4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x774ac134", "parentcaller": "0x766f1389", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004f8" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f6a20", "parentcaller": "0x777f9456", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x8f\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf4\\xce\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0I\\x13\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x1c\\xc1\\x16\\x03\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x04\\xb1\\x14\\x03\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00\\x00\\xb1\\x14\\x03\\x00\\x00#\\x00\\x04\\xe9\\xf8\\xe8\\xf8\\x04\\x00\\x00\\x9c\\xf6\\x00\\x00\\x00\\x00\\x0c\\x03#\\x00\\x00\\xc0\\xf8\\x04\\x00\\x00L\\xe9\\xcd\\x05\\xb3\\x91\\x7fw\\xf8\\x04\\x00\\x00" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3jt\\x9d\\xf0\\x03\\x9c\\xf6\\xea\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xc9\\xfc\\xa7\\xe7\\xf4\\xe3\\xcd\\x05\\xf8\\x04\\x00\\x00|\\xef\\xcd\\x05\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\x04\\xe9\\xcd\\x05\\x96\\x19\\xbdjE\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f6a20", "parentcaller": "0x777f7151", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x8f\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xd6Z\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f90c4", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "T\\xce\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9103", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "(C\\x13\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00w\\x00i\\x00n\\x00n\\x00l\\x00s\\x00r\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9120", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f915f", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "l\\xbf\\x16\\x03\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9178", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f91b3", "parentcaller": "0x777f6ac5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "T\\xaf\\x14\\x03\\x02\\x00<\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x02\\xa0\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f9240", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\xdbj|_\\xdbj\\x06\\x00\\x00\\x00h_\\xdbj@\\x00\\x00\\x00P\\xaf\\x14\\x03\\x00\\x00#\\x00\\xec\\xe6\\xe0\\xe6\\xf8\\x04\\x00\\x00\\x9c\\xf6\\x00\\x00\\x00\\x00\\x0c\\x03#\\x00\\x00\\xc0\\xf8\\x04\\x00\\x004\\xe7\\xcd\\x05\\xb3\\x91\\x7fw\\xf8\\x04\\x00\\x00" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f926e", "parentcaller": "0x777f91c3", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\xe3jt\\x9d\\xf0\\x03\\x9c\\xf6\\xea\\x03#\\x00\\x00\\xc0\\xec\\xa8\\xb9j\\xe1\\xf2\\xa7\\xe7\\xdc\\xe1\\xcd\\x05\\xf8\\x04\\x00\\x00|\\xef\\xcd\\x05\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\xec\\xe6\\xcd\\x05\\x96\\x19\\xbdjE\\x00\\x00\\x00\\x04:\\xdbj\\x98_\\xdbj" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f95ab", "parentcaller": "0x777f76fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe9\\xcd\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x000\\xe9\\xcd\\x05|\\x86\\x7fw\\x00 \\x14\\x03X\\xe9\\xcd\\x05\\x0c\\x00\\x00\\x00h\\xe9\\xcd\\x05t\\x88\\x7fw\\x14 \\x14\\x03X\\xe9\\xcd\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x88\\x7fw\\x00\\x00\\x00\\x00\\x00\\x03\\xcd\\x05" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f95f2", "parentcaller": "0x777f76fc", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 10:44:52,956", "thread_id": "11172", "caller": "0x777f962c", "parentcaller": "0x777f76fc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "\\x04\\x00\\x00\\x00,q\\x15\\x03\\x0e\\x00\\x00\\x00^@R\\xc0\\xe9I0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760b2a67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760b0eec", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760b71d3", "parentcaller": "0x760b69bd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x8e0\\x82\\x02v\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x03:\\xf1\\xe6\\xa7\\x11\\xa9\\xa0\\xbb(d\\xb1\\x1d\t\\xfa\\xe50\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G20\\x1e\\x17\r130801120000Z\\x17\r380115120000Z0a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17Dig" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749e94b", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2521 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046c" }, { "name": "ObjectAttributesName", "value": "EncodingType 0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000508" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760b13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046c" }, { "name": "ObjectAttributesName", "value": "EncodingType 1" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749e99b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000508" }, { "name": "ObjectAttributesName", "value": "CertDllVerifyCertificateChainPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760b13ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef8eb", "parentcaller": "0x7749cdae", "category": "registry", "api": "NtEnumerateKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760b13cb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760a9148", "parentcaller": "0x760a90fd", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0+\\x82\\x15config.edge.skype.com\\x82\\x12*.config.skype.com" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774aac59", "parentcaller": "0x77497e35", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774aac59", "parentcaller": "0x77497e35", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2536 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2538 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2540 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2542 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2544 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "ValueName", "value": "PinRulesLogDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "ValueName", "value": "PinRules" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2548 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "ValueName", "value": "PinRulesLastSyncTime" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x18\\xedv\\x16X\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760a80d7", "parentcaller": "0x760a8043", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7780c23d", "parentcaller": "0x7780c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d0" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7780c245", "parentcaller": "0x7780c181", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a9e76", "parentcaller": "0x760a8665", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x760a867d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ac134", "parentcaller": "0x760c86e5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005cc" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a9e76", "parentcaller": "0x760c89b9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xef\\xf5\\x05\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00$\\xf0\\xf5\\x05P\\xf0\\xf5\\x05d\\xff\\xbbj\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\xe4\\x9f\\xe74\\xc1Jw\\x00\\x00\\x00\\x00\\xe5\\x86\\x0cv-\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\xf6\\x05\\x00\\x00\\x00\\x00\\x18\\xf0\\xf5\\x05\\x1f\\xdd\\xbbj\\x18\\xfc\\xf5\\x054\\xc1Jw\\xc8K\\xddj\\xe5\\x86\\x0cv\\x90\\xf0\\xf5\\x05\\x96\\xe3\\xbbj\\xf0\\xf5\\xdaj\\x8c\\xae\\xe3j\\xac\\x9d\\xf0\\x03\\xc8K\\xddj\\xf9\\xe4\\x9f\\xe7\\xc4\\xeb\\xf5\\x05\\xec\\xa8\\xb9j\\x18\\xfc\\xf5\\x05\\xa0\\xe6\\xd0jU\\xb5\\xb6\\x88\\xfe\\xff\\xff\\xff\\xdc\\xf0\\xf5\\x05\\x06\\x19\\xbdjF\\x00\\x00\\x00\\x04:\\xdbjT_\\xdbj\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\xdbj\\x0c]\\xdbj\\xff\\xff\\xff\\xffP%\\xdbj\\x08\\x00\\x00\\x00@_\\xdbj\\x1c\\xf1\\xf5\\x05x\\xf3<\\xf1\\xdc\\xf0\\xcc\\xf0@\\xf1\\x00\\x00\\xdc\\x07\\x00\\x00x\\xf3\\xf5\\x05<\\xf1\\xf5\\x05@\\xf1\\xf5\\x05\\x00\\x00\\x00\\x00\\xf0\\xf0\\xf5\\x054\\xc1Jw\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\x1c\\xf1\\xf5\\x05" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774aab1a", "parentcaller": "0x760c870c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2560 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x000002b4" }, { "name": "ObjectAttributesName", "value": "S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000005cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760a81e2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x7749f8f1", "parentcaller": "0x7749f6cb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2564 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774ef5cb", "parentcaller": "0x7749f71e", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000010c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a5000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eec2a", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031aa000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774eecbb", "parentcaller": "0x7749f370", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "ValueName", "value": "PinRulesEncodedCtl" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760b75fe", "parentcaller": "0x760c0615", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x800\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x00\\x00\\x00" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760b75fe", "parentcaller": "0x760c07c2", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "0\\x82\\x07\\xb80\\x82\\x07\\x95\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03!\\x01\\x01\\xff\\x04\\x82\\x07\\x820\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*" }, { "name": "Flags", "value": "0x00008004" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x774a040b", "parentcaller": "0x760a8148", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c3ca9", "parentcaller": "0x760a3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xb1\\x02\\x01\\x00\\x02\\x01\\x010\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x08\\x02\\x01\\x00\\x02\\x01\\x010\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0c62", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0cd7", "parentcaller": "0x760c3d04", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "0\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c0b98", "parentcaller": "0x760c0d17", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c3d6d", "parentcaller": "0x760a3f13", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00000001" }, { "name": "Encoded", "value": "\\x17\r180601232859Z" }, { "name": "Flags", "value": "0x00000000" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760c3ac2", "parentcaller": "0x760abd4a", "category": "crypto", "api": "CryptDecodeObjectEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "CertEncodingType", "value": "0x00010001" }, { "name": "Encoded", "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01" }, { "name": "Flags", "value": "0x00008005" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x760aa2a6", "parentcaller": "0x760a9622", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x777e058c", "parentcaller": "0x777e7ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060f0000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x777e05eb", "parentcaller": "0x777e7ac3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060f0000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x777e07c7", "parentcaller": "0x777e04cf", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06102000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x6a9f46bc", "parentcaller": "0x6a9f463b", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x6cef6758", "parentcaller": "0x6cef6465", "category": "crypto", "api": "BCryptEncrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Input", "value": "\\xd0\\x80\\xcd\\xa3xQJ\\x11\\xc0\\x8cI\\xb1V\\xf3\\x98\\x01y\\xed\\xc2j\\xb6H\\xcd\\xe29c\\xb3\\xe9\\xe5\\xfe\\xceW\\xa3l\\xc1,Wm\\xbd\\xb3\\x0b_{\\x1d\\x045\\xce\\x12+\\xf5]\\x8d^\\xddIz\\x11\\x839\\x9b\\xfd\\xe1-\\xe4+J\\xf9&J\\xbb\\xec\\x06>F|4\\xb0\\xc5\\x13\\xf5\\xd8E\\xf5\\x83\\xe6\\xda\\xee2\\x91\\x08\\xf3?\\xa6*\\xa4&wbK\\xf6c`\\x00\n\\xa7\\x1b\\xb5\\xb0q\\xba\\xb3\\x03\\xc1\\xa6\\xb8\\x134y\\xe7\\xf8\\x99C~)B\\xaf_\\x1d\\xf4\t>\\xb1\\xf5#O\\xb5\\xf0\\x12\\xd4>m\\x87\\xfd\\x10z\\xa6\\xce\\xfa\\xb2g)H\\x11?9r'8\\xf2[\\x83qk\\x96\\xa8\\x08\\x03\\x97\\xc75E\\xcd\\xe8/=\\x05.\\x99\\x9c\\x01\\x8e\\x87\\xed\\x1bb\\x9e\\x93\\xddDj,r\\xda\\x9b\\x98\\xda\\xba\\xec]G\\xe4g\\xc2\t\\x88\\xe42\\x8c\\x1b\\x06\\xd5\\xf0\\xdd\\xe60\\x86\\xc7\\xf1\n\\x97\\xc4_r-\\xe3/bpBk\\x80\\xe3e\\x8b),\\x11a\\xf9\\x8b\\xe6\\xe6T\\xea\\xcc\\x18\"\\xcc\\x17\\x8e\\xec\\xc95\\xbb)\\xd5\\x9e\\xd7\\xa1p\\xd7O\\x8et\\x06\\xfeV\\x1b\\xcf\\xb2pC76%\\xf2\\xfeQ$\\xd2\\xec\\xfa\\x8f\\x92\\x0c\\xba:\\x7f\\xeb\\xcf`\\xd1.X\\x80\\xd84\\xac\\x00\\x9ey\\x98\\x82e\\xa3:\\x9c\\xf0D\\xe3J$\\xd4\\xf2\\xd2\\xf1\\xdf\\xe2\\x84\\x10\\xb9\\x99\\x87\\x187\\xd5A\\xcf\\x7f9\\x01\t\\xdd\\xff\"\"uYc\\x97\\x07\\xf9\\xfa\\xad\\x93\\xe1\\x9b\\x1f\\x9b\\xdchg\\x1ef\\x8a\\xbfpn\\x00\\x8f1(\\x8e\\xc3\\xae5\\x9a\\xecB\\xcb\\x0f\\xe5\\xb1\\xe3\\x04fP\\xe9e\\xcaFK\\x0bT4&\\xf5\r#Q\\x04\\x8eP\\xc2\\xba \n\\x86r\\xac\\xcf\\xa4T\\xc3\\x8e\\xdb\\x16\\xf0\\xc3\\x97\\x1dr,X\\xc2@\\xc7\\xca\\x8e\\x02\\x1f\\xdb\\xcf\\xe1\\x91=\\x93\\xf0\\xe3\\xdf\\xcaR\\xda\\x95\\xe60\\xf1\\xf0!%\\xb9\\x94>~h\\xe5>\\xbb\\x08$,\\xbel\\x05X\\xcd\\xdf\\x00'\\xa2\t\\x94\\xe3,/\\x1ad\\xa6\\xd1@k\\x95F\\x82\\xd5\\xf6\\xa8?\\xa7E\\x9c\\xaa\\x0b^\\x91{\\x94\\x11\\xf8\\x88\\x1c\\x9c\\xbf\\xa7\\xf2v\\xb0\\xf2\\xb9\\xd1\\xf8|\\x15,z\\xbd\\xc61\\xd1\\x07\\xf0\\x90\\xd5\\xb3\\xa5\\x82\\xfc@w\\xc9l-\\xe5\\xf0q\\x0e\\xbe\\xe9\\xfd\\xe2z\\xd4\\xe8\\x01\\xf4\\xcf=\\x1a\\xf2LZ\\xed\\xb0P*!u\"\\x99F\\xc2&\\xad\\xe2[!g.\\xa6-Y\\xbf,~1\\x17T\\xd1'\\x14\\xd1\\x16'\\x96\\xdf\\x94\\xe9e~\\xb6;\\x8c\\x83$\\x1au\\x18\\xc8\\xaf\\x87\\x10-4\\xa0\\xe8w\\x10\\xeey\\x1f\\x81J\\x88>\\xfe\\xbc\\x06\\xde6\\xf4\\x97\\xb6>\\x1b\\x94Hg\\xc0yd\\x81\\xbd/c\\x15\\x81\\xb4l\\x8d_\\x7f;W\\xc0\\xd8\\x03\\xb6\\xcd\\xb9\\xda\\x8f\\x11I\\xe2\\xb86\\xd7r\\xaa\\xd6%\"\\x03\\xf51c\\x90H!\\x17&\\x043xZ\\xa5>\\xc3oe\\xa4\\xf867\\x82k[\\xe6\\xb6\\xa9\\xf5M\\xc4\\xe4\\x83\\xaed\\xc7)v\\x08\\xedw\\x8d\\x8d\\x053\\xc3G\\x9f\\xa9/\\x9c\\x0bo\\xd8\\xc7J\\xdeb\\xb4si\\xcbYwD\\x10I\\x83\\xba\\xb6\r\\xa8\\xc8\\xf1\\x94\\x1a\\xb2\\x03\\x92\\x9b\\\\xef\\xd0\\x820\\x9c<\\xfa\nQ\\x9b\\x01fh\\xa6rEn\\x16\\xccV\\x1a{\\x9d\\x83\\xf7r^\\x9f\\xd1\\xf4h\\xe7/?s\\x9d\\x7f\\xbd\\xbc\\xcd [\\xd5\\xaa\\xee\\xe7&\\xb07\\x1f\\x90\\xea\\xe6\\xd1\\x860}\\]X\\x1f.6\\xe0D\\x18\\x0e9\\x85\\x96B\\x18\\x9e\\x8d\\xe6\\xe2\\xb4\\xde\\x7f\\x96 \\xb9C\\xf6\\x9b\\xf1\\x02\\x19\\xbe \\xc7\\xca\\xf1\\x1bY\\xf4Fi\\x13|\\\\xbfF\\x85\\xcb\\xf8\\xcc\\xdd\\x8fu\\xc7X\\xe9=\\xd4 m\\xf3\\xd7\\x05&\\xdb\\x9f\\xc6\\x1c\\xa4\\xfcy\\x8d\\x95\\xfe)\\xd4\\xcf\\xf5\\xa5\\xe5>\\xe4}\\xe1.\\x84\\xd8G\\xa7\\xa2\\x0f|\\x00b4k\\x1f^\\xc1\\x06\\xcbE)\\xf6\\xe4\\xa5\\xb7\\xa2rey7\\x94\\x96@\\xfa]\\xb7\\x02B\\x12\\xd7A\\x87\\x14\\xe6\rW\\x1dC,+\\xeb\\x05\\x82\\xc6\\xaf!\\x00\\x06\\xfa\\xb6\\xe2%\\x87'[\\xe0\\xb2\\xca\\xcfl\\xc2\\x88X\\xd4e|\\xba\\x03\\x0cZ\\xfc\\x1emr\\xdaB\\xb3J\"\\x11v\\xa67\\x88\\xce\\xaa\\xe1\\xd3\t{Y\\xa7\\xdc\\xe0b\\xd5&\\xc1\\x1a\\xda\\xf5\\xea-\\xed\\xed'(\\x1c\\x14i\\xdc\\xb8\\x15\\xd9\\x96CC\\x97l\\xc9'\\x17\\x91\\x0f\\xd6w\\xf5\\x97OY:4\\xbf\\xec}\\xf3L\\xdbE\nU\\xae@\\x1f\\xb5`y`\\x03ce\\x1f\\x92\\x13\\xb5\\xcc\\x94\\xe9\\x1a\\xaf\\xe0\\xee\\x7f\\x80@[Y\\xc1=\\x8cU\\xeebO\\xcbj+c;\\x8e\\xb4Ten.\\xbf\\xae\\xa0\\xa7\\xd2\\x95\\xf20\\x9d1\\xa6\\xf1\t\\xfa\\xfc1\\xf45\\xbf\nW=]\\x9d\\xc7\\x97\\x9c\\xea\\xe6\\xe7\\x9f\\xe5\\xf0\\x8b\\xf7\\x07\\xe3\\x186\\xae\\xab\\x05\\xb6~1i\\xa6\\xec\\x19G\\x91\\x01'\\xcb\\xea\\xc4\\x9d\\xad\\x8f&\\x05\\x19\\x13\\x19t\\x1a}\\x0bG\\x90\\xc0\\xe4\\xdb\\xcb\\x9ef\\xb1\\x89X\\x92Kj\\xf5\\xb9wI&O9!\\x00\\xa8\\xffH\\xa8'\\xc7\\xa0=^?\\x96\\x0c\\xe5\\x05\\xac\\x15z\\x9d\\x9eT\\xfa\\x18\\xa4x\\xee\\x03\\xfah\\x1b|\\xb5\\xb7\\xe4\\x10\\xf2\\xa2N-m\\xd0\\xa1\\x17\\xa2\\xbb@\\x03\\x86\\x8eq\\xde\\x91f3ihu]RJM\\x15V\\xa0\\x03amQ\\x90-e\\xc2\\xa0\\xb8\\xf5!e\\xa1\\xeb\\xcd\\xd18\\x11\\xdb\",\\x0c\\x94\\xcc{y\\x98\\x18p\\x15eA\\xb3X\\xeeF\\x9a\\xfc\\xf9\\x052\\xe1>JU\\xb6\\xfa=\\xe9\\xaf\\x81y&\\xfd\\x1f\\x89x\\x9e\\xc7\\xe9\\xe0\\xae\\x89\\xb0\\xf0\\xae\\x96W\\xa4\\xf5\\xbe\\x9e\\xf8\\x8d\\x81\\x99\\xad\\x8f/-t9\\x87l\\x10\\xf8\\x91\\x1b\\x8c\\xe3\\x01O\"%\\xecf\\xb2\\x1egn]:b\\xb3\\xa8\\x9e\\xc6+\\xda\\xf3\\x08D\\xacf.\\xe73:T\\xd1\"s[_x\\xd5~E\\x02*\\x86<\\xb8 \"\\xe0D\\x82\\xc7\\xd9\\x89mG{\\x11\\x8f\\x02\\xd5\\x9f\\xdf\\xd4\\xaa\\xa3\\x868\\xf2N\\xfau1\\xe4,\\x84|/\\xe7\\xe5\\xf0\\xd6\\x8f\\xb6r}\\x94\\xf3mK\\x0c\\x15\\xb60:l\\xfe\\xebI\\x18\\xcf\\xde\\xe5\\xb4\\x16;T\\x0e\\xe6\\xbf\\xe2U&]\\xde\\xd6\\x12\\x04t\\x9f\\x84wL\\xc4\\x17\\x96i\\xa1\\xe1\\xc0j\\xf2\\xb6\\xc8\\xea\\x08\\x89\\xca\\\\x92\\xec\\xb8}\\x87\\x9d\\xe1\\x1f\\xad\\x88\\xaa\\xc5\\xd5\\xc7G\\xa1^\\xb2\\x84C\\xc4(\\x8a^\\xc6\\x97\\xb5\\xbb\\xa4\\xa9\\xff\\xd2\\xf8J\\xfb\\x1bEx\\xdd\\x0fb\\xacT\\xf9\\x99^\\x07\\x88\\xf5\\xad\\x01;\\x12\\x91\\xd4\\xce\\x16RD\\x98\\x84\\xa5" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x6a9ece77", "parentcaller": "0x6a9ec83e", "category": "network", "api": "WSARecv", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1304" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x6cef6c84", "parentcaller": "0x6cef69da", "category": "crypto", "api": "BCryptDecrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Output", "value": "\\x00\\x00\\x12\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00d\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x04\\x00\\x80\\x00\\x00\\x00\\x00\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\x01\\x0f\\xc4p\\x03\\xaa\\xfc\\xc1\\x91\\x11\\xcb\\xb5\\xc5\\x91\\x161(" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x031925b0" }, { "name": "Length", "value": "56" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "7024", "caller": "0x6a9ece77", "parentcaller": "0x6a9ec83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1304" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11172", "caller": "0x6cef6758", "parentcaller": "0x6cef6465", "category": "crypto", "api": "BCryptEncrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Input", "value": "\\x1d\\x1c]\\xbf\\xcf\\xed(\\x12x" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x031932b0" }, { "name": "Length", "value": "9" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11172", "caller": "0x6a9eb419", "parentcaller": "0x6a9eae23", "category": "network", "api": "WSASend", "status": true, "return": "0x00000000", "arguments": [ { "name": "Socket", "value": "1304" }, { "name": "Buffer", "value": "\\x17\\x03\\x03\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x1d\\x1c]\\xbf\\xcf\\xed(\\x12x\\xeb\\xf9#\\xd1\\xfc\\xe0\\x07\\x9fLW\\x18pP\\x1a\\x1b?" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11324", "caller": "0x778065e6", "parentcaller": "0x778064f1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11324", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11324", "caller": "0x6cef6c84", "parentcaller": "0x6cef69da", "category": "crypto", "api": "BCryptDecrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Output", "value": "\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00k\\xcf\\x8b\\xa8@\\xe4\\xdaZ\\x97|\\xb1I\r\\xdf9\\xcf" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x031925b0" }, { "name": "Length", "value": "25" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 10:44:53,034", "thread_id": "11324", "caller": "0x6a9ece77", "parentcaller": "0x6a9ec83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1304" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 10:44:53,237", "thread_id": "11324", "caller": "0x6cef6c84", "parentcaller": "0x6cef69da", "category": "crypto", "api": "BCryptDecrypt", "status": true, "return": "0x00000000", "arguments": [ { "name": "Output", "value": "\\x00\\x02=\\x01\\x04\\x00\\x00\\x00\\x01\\x8bX\\x8f\\xa8\\xeb\\x10d\\x9c\\xbfT\\x8f\\xca\\xc3\\x98\\xb02\\xe0\\x01_\\x8b\\x1du\\xd0b\r&=LtA\\xead\\x97\\xc3a\\xbe\\x94\\x13\\xeah\\x1f\\xa5\\x04\\x018\\xa0\\x1d\\xb8\\xd3W\\x1bmLZ7\\xffb\\xa7\\xfe\\x7fZ\\xe7\\xa6\\x1eZ\\xf4j\\xa3\\x1eX\\xfb\\xcd\\xf8\\xc9cq\\x13y\\xf3\\xde\\xec=7\\xcb\\xfb\\x9e=\\xb5\\xe9\\x9aI-\\xcf\\xfe\\xcf\\x07\\xf3u\\x82|\\x00@\\x90\\xf2\\xb1\\x0fRKRVO\\xaa\\xca\\xb1\\xebI\\x8fR?\\x85\\xa8\\xe8\\xa8\\xd2\\xcb@\\x8b\\xf2\\xb4\\xb6\\x0e\\x92\\xacz\\xd2c\\xd4\\x8f\\x04DENYx\\x9a\\xa4~V\\x1c\\xc5\\x81\\x90\\xb6\\xcb\\x80\\x00>\\xd45D\\xa2\\xd9\\x0b\\xba\\xd8\\xef\\x9e\\x91\\x9a\\xa4\\x7f@\\x87\\xb0\\xb5\\x9e\\xc4\\xac\\x93\\xff\\xff'\\xff\\xfd\\xfc\\xcda\\xed\\xaf\\xf9\\xb9\\xfc\\xe9-\\x18\\x08\\x8e\\x15\\xd0q\\xc8\\x1f\\xe7\\xeb\\xf9\\xa4~b\\x1c\\xc5\\xfen8\\x06\\x9e\\x00>\\xbf\\x92\\xd5%g5IG\\xf3s\\xff\\x7f\\xff\\xbf\\x9bl\\xa3\\xf9\\xb9\\xfc\\xce\\x94\\xd6\\x8b\\x8c0R!z\\x8b" }, { "name": "IV", "value": "" }, { "name": "Flags", "value": "0x00000000" }, { "name": "CryptKey", "value": "0x031925b0" }, { "name": "Length", "value": "607" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 10:44:53,237", "thread_id": "11324", "caller": "0x6a9ece77", "parentcaller": "0x6a9ec83e", "category": "network", "api": "WSARecv", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "socket", "value": "1304" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11324", "caller": "0x777cfaf4", "parentcaller": "0x777cf7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06102000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11324", "caller": "0x777cfaf4", "parentcaller": "0x777cf7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11324", "caller": "0x777cfaf4", "parentcaller": "0x777cf7db", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11324", "caller": "0x777cf655", "parentcaller": "0x777e46e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06102000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 2648 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xf8\\x87\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf8\\x87\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xf8\\x87\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf8\\x87\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x003\\x00.\\x002\\x005\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00S\\x00i\\x00m\\x00p\\x00l\\x00e\\x00R\\x00e\\x00q\\x00u\\x00e\\x00s\\x00t\\x00:\\x00:\\x00S\\x00e\\x00n\\x00d\\x00R\\x00e\\x00q\\x00u\\x00e\\x00s\\x00t\\x00]\\x00[\\x00r\\x00e\\x00q\\x00u\\x00e\\x00s\\x00t\\x00 \\x00s\\x00e\\x00n\\x00t\\x00]\\x00[\\x00s\\x00e\\x00r\\x00v\\x00e\\x00r\\x00:\\x00 \\x00c\\x00o\\x00n\\x00f\\x00i\\x00g\\x00.\\x00e\\x00d\\x00g\\x00e\\x00.\\x00s\\x00k\\x00y\\x00p\\x00e\\x00.\\x00c\\x00o\\x00m\\x00]\\x00[\\x00I\\x00P\\x00:\\x00 \\x001\\x005\\x000\\x00.\\x001\\x007\\x001\\x00.\\x002\\x002\\x00.\\x001\\x007\\x00]\\x00" }, { "name": "Length", "value": "184" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "\r\\x00\n\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpReceiveResponse", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 2, "id": 2661 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 1, "id": 2663 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 1, "id": 2665 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2667 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00@\\x89\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x89\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00@\\x89\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x89\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x000\\x005\\x00/\\x002\\x009\\x00/\\x002\\x006\\x00 \\x000\\x006\\x00:\\x004\\x004\\x00:\\x005\\x003\\x00.\\x002\\x005\\x003\\x00]\\x00[\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00:\\x00m\\x00s\\x00e\\x00d\\x00g\\x00e\\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00]\\x00[\\x001\\x001\\x001\\x003\\x002\\x00:\\x001\\x001\\x001\\x003\\x006\\x00]\\x00" }, { "name": "Length", "value": "140" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "Buffer", "value": "[\\x00W\\x00i\\x00n\\x00H\\x00t\\x00t\\x00p\\x00 \\x00s\\x00t\\x00a\\x00t\\x00u\\x00s\\x00 \\x00c\\x00a\\x00l\\x00l\\x00b\\x00a\\x00c\\x00k\\x00]\\x00[\\x000\\x003\\x001\\x005\\x007\\x001\\x006\\x008\\x00]\\x00[\\x00h\\x00a\\x00n\\x00d\\x00l\\x00e\\x00=\\x000\\x003\\x001\\x002\\x004\\x000\\x001\\x008\\x00]\\x00[\\x00c\\x00o\\x00n\\x00n\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00 \\x00c\\x00l\\x00o\\x00s\\x00i\\x00n\\x00g\\x00]\\x00" }, { "name": "Length", "value": "144" }, { "name": "Status", "value": "Maximum logged writes reached for this file" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2676 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00`\\x8a\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`\\x8a\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00`\\x8a\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "`\\x8a\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 2683 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": false, "return": "0x00000000", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "WinHttpQueryHeaders", "status": true, "return": "0x00000001", "arguments": [ { "name": "InternetHandle", "value": "0x03124018" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x88\\xf6\\xcf\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\t\\x00\\x02\\x00\\x98\\x97\\x19\\x03h\\x9d\\x19\\x03\\xc8N\\x15\\x03\\x00\\x00\\x0c\\x03\\x00\\x00\\x00\\x00\\xd8\\xf6\\xcf\\x02V<~w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005dc" }, { "name": "DesiredAccess", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\proxy" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f023f", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK|STANDARD_RIGHTS_REQUIRED|0x00000200" }, { "name": "Handle", "value": "0x000005e0" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\proxy" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000005e0" }, { "name": "ValueName", "value": "source" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e0" }, { "name": "ValueName", "value": "source" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "IEWPAD" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegSetValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ee20" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e0" }, { "name": "ValueName", "value": "source" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Buffer", "value": "IEWPAD" }, { "name": "BufferLength", "value": "14" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e0" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2703 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00~\\x8b\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "~\\x8b\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00~\\x8b\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "~\\x8b\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2710 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00|\\x8c\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "|\\x8c\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00|\\x8c\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "|\\x8c\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "experiment_control_labels" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2729 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "1.3.233.3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "opv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\opv" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2740 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00r\\x8d\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "r\\x8d\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00r\\x8d\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "r\\x8d\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "EventWriteTransfer" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77803ec0" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "opv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\opv" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2761 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\x8e\\x8e\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\\x8e\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\x8e\\x8e\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\\x8e\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "pv" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "148.0.3967.83" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x0000042c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000042c" }, { "name": "ValueName", "value": "opv" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\opv" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2779 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xaa\\x8f\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xaa\\x8f\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\\xaa\\x8f\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xaa\\x8f\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d8" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "DPAPI.DLL" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005d8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dpapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000005d8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\dpapi.dll" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e5000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d8" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6e2e4000" }, { "name": "ModuleName", "value": "DPAPI.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x6e2e0000" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dpapi" }, { "name": "BaseAddress", "value": "0x6e2e0000" }, { "name": "InitRoutine", "value": "0x6e2e1dc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x753f8000" }, { "name": "ModuleName", "value": "winhttp.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" }, { "name": "Milliseconds", "value": "120000" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c0" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11172", "caller": "0x766f0f20", "parentcaller": "0x766e117e", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11172", "caller": "0x766e1284", "parentcaller": "0x766e121d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03127000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03158000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0315c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03130000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0319f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0310e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03123000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0313c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03153000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05230000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netprofm" }, { "name": "DllBase", "value": "0x73eb0000" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73eb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05af1000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae5000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05aed000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05992000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae5000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05992000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05920000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05930000" }, { "name": "RegionSize", "value": "0x0001b000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05ae0000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05990000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x6f0b0000" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f0b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x73ea0000" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73ea0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76810000" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdateDev\\" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\" }, { "name": "Handle", "value": "0x0000035c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegQueryInfoKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed30" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "3" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "RegEnumKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75e6ed00" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0319f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000348" }, { "name": "ValueName", "value": "usagestats" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000348" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000348" }, { "name": "ValueName", "value": "usagestats" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "MutexName", "value": "Global\\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000348" }, { "name": "SubKey", "value": "Integers" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x0000034c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "omaha_version" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x03\\x00\\xe9\\x00\\x03\\x00\\x01\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\omaha_version" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000348" }, { "name": "SubKey", "value": "Booleans" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x00000374" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "ValueName", "value": "is_system_install" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\\x01\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\is_system_install" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000348" }, { "name": "SubKey", "value": "Counts" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0002001f", "pretty_value": "KEY_READ|KEY_WRITE" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "goopdate_main" }, { "name": "Data", "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "goopdate_main" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "goopdate_constructor" }, { "name": "Data", "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "goopdate_constructor" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegSetValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "ValueName", "value": "windows_major_version" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Buffer", "value": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "BufferLength", "value": "8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\windows_major_version" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 1, "id": 2916 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "shutdown", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1304" }, { "name": "how", "value": "1" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "network", "api": "closesocket", "status": true, "return": "0x00000000", "arguments": [ { "name": "socket", "value": "1304" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11172", "caller": "0x777cf655", "parentcaller": "0x777e46e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06102000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06101000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x060f1000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06101000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xa1\\x02|+\\x00\\x00\\x80+\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11136" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xa1\\x02|+\\x00\\x00\\x80+\\x00\\x00?\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11136" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x75362629", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03127000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06101000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x031a7000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03127000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03173000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03170000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0318f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0318b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043c" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000410" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000040c" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000430" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11172", "caller": "0x774aab1a", "parentcaller": "0x75398afe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11324", "caller": "0x777cf655", "parentcaller": "0x777e46e3", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03158000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000420" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\diagnosticdataquery" }, { "name": "DllBase", "value": "0x73e90000" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e90000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "8548", "caller": "0x7780b6b6", "parentcaller": "0x774cf8c5", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8548" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "8548", "caller": "0x7780b6d9", "parentcaller": "0x774cf8c5", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000330" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00 \\x00\\x00|+\\x00\\x00d!\\x00\\x00?\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8548" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03123000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2961 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "500" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\n\\x00\\x00\\x00\\x00\\x00\\xc8\\x90\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x210\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xc0\n\\x00\\x00\\x00\\x00\\x00\\xc8\\x90\n\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x210\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x001598a9", "parentcaller": "0x0015ad63", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 10:44:53,253", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "synchronization", "api": "NtReleaseMutant", "status": false, "return": "0xffffffffc0000046", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75e50000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777f9a30" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6b09d000" }, { "name": "ModuleName", "value": "msedgeupdate.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77390000" }, { "name": "FunctionName", "value": "FlsFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x774d03f0" } ], "repeated": 1, "id": 2976 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate" }, { "name": "DllBase", "value": "0x6aeb0000" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x70670000" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x6ec40000" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x6ebd0000" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ebd0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x741d0000" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ec40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x70670000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VERSION" }, { "name": "DllBase", "value": "0x75460000" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75460000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x75450000" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x6ae60000" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6ae60000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75450000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETUTILS" }, { "name": "DllBase", "value": "0x74890000" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74890000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WKSCLI" }, { "name": "DllBase", "value": "0x748a0000" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x748a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x778c9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015936c", "parentcaller": "0x0015b7fa", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6aeb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x74950000" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x00161c22", "parentcaller": "0x00161ce7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74950000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x00161cf7", "parentcaller": "0x00161d44", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x74950000" }, { "name": "FunctionName", "value": "AppPolicyGetProcessTerminationMethod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74953a40" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ecf2", "parentcaller": "0x0015ec89", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0xfffffffa" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000058c" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000598" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a0" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000584" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056c" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0318f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05f80000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05240000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d4" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d8" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c8" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x757e2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x757e2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003dc" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000013c" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000ec" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000ec" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000dc" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000cc" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x777a0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x777ff560" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ac" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 10:44:53,268", "thread_id": "11136", "caller": "0x0015ec93", "parentcaller": "0x0015ec51", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 3168 } ], "threads": [ "11136", "11236", "11248", "11244", "11240", "8548", "11172", "6408", "7024", "11284", "11324" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00150000", "MainExeSize": "0x00035000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 11836, "process_name": "SecurityHealthHost.exe", "parent_id": 832, "module_path": "C:\\Windows\\System32\\SecurityHealthHost.exe", "first_seen": "2026-05-29 10:45:20,853", "calls": [ { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11960", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd3b2", "parentcaller": "0x7ff652cfd480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb49000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd3b2", "parentcaller": "0x7ff652cfd480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb4a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd3b2", "parentcaller": "0x7ff652cfd480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb4b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd3b2", "parentcaller": "0x7ff652cfd480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdaa2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11956", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb4d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd9a9", "parentcaller": "0x7ff652cfd480", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd9dc", "parentcaller": "0x7ff652cfd480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb9f40" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd9f0", "parentcaller": "0x7ff652cfd480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57813890" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfda04", "parentcaller": "0x7ff652cfd480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fa5430" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfd409", "parentcaller": "0x7ff652cfd4a1", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff652cfdfe0" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11956", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11956", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfb3de", "parentcaller": "0x7ff652cfb36f", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MsMpLics.dll" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf8a32", "parentcaller": "0x7ff652cf5a8c", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "MutexName", "value": "Local\\SM0:11836:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11968", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11968", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11960", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb4f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf8a60", "parentcaller": "0x7ff652cf5a8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf4b8d", "parentcaller": "0x7ff652cf8b97", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11960", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11960", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf4baa", "parentcaller": "0x7ff652cf8b97", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf523f", "parentcaller": "0x7ff652cf8b07", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf36b5", "parentcaller": "0x7ff652cf38f4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000204" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb50000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000248" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001f4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001f4" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001f4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001f4" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001f8" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001f4" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001f8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000001f8" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xf8d\\x12\\x80\\xd3\\x06],\\xe4\\xb3Gz\\x02\\x7f\\xe4\\x89\\x9b\\xb4\\xe5\\xf5\\xc7\\x82\\xc2g\\xab\\xb6;b\\xa7\\xd1\\xbf0\\xf9\\xb2\\xa9O1h\\xccAg\\xd1g\\xe0\\xb5\\xb2\\xaa\\xf3" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfc5d0", "parentcaller": "0x7ff652cf16da", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb51000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1747", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1747", "parentcaller": "0x7ff652cf1c99", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfb835", "parentcaller": "0x7ff652cf14db", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "Handle", "value": "0x00000272" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cfbb5f", "parentcaller": "0x7ff652cfbc9c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000272" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf15fd", "parentcaller": "0x7ff652cf17e7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000272" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb58000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb59000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" }, { "name": "Handle", "value": "0x00000276" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:45:20,931", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000278" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000278" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x90\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00`\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf1840", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "Handle", "value": "0x00000276" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xe3\\x96*\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00v\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00 \\xe4\\x96*\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000276" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Shield Provider User Session Agent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000276" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000027e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocServer32" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 131 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe1\\x96*\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00v\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xb0\\xe2\\x96*\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000276" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe1\\x96*\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00v\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xb0\\xe2\\x96*\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000276" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000276" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x240fdaa0000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00002e3c" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.11836" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb5b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb5c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000286" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000286" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000028a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028a" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000286" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb5e000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000284" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000288" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xfc\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00t\\x00.\\x00" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xff\\xb4\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00d\\x00o\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00t\\x00.\\x00d\\x00l\\x00" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\xc0\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x00\\xb5\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00;XF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xd0\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xc8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xb8\\xe4\\x96*" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\xb5\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xf9\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xfa\\xb4\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xfe\\xb4\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xdb\\F5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x000\\xe1\\x96*\\xe0\\x00\\x00\\x00(\\xe1\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe0\\x96*\\xe0\\x00\\x00\\x00\\x18\\xe1\\x96*" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfe\\xb4\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xdf\\x96*\\xe0\\x00\\x00\\x00\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x240fdb47c80" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "12044" }, { "name": "ProcessId", "value": "11836" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000028c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x240fdb47c80" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "12044" }, { "name": "ProcessId", "value": "11836" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12044", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12044", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x240fdb47c80" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x12\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00KdF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe8\\x96*\\xe0\\x00\\x00\\x00h\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x88\\xe8\\x96*" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe6\\x96*\\xe0\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\x14\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xebXF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xe5\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xc8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xe8\\xe4\\x96*" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000028c" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x12\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x14\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00KdF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe8\\x96*\\xe0\\x00\\x00\\x00h\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x88\\xe8\\x96*" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x14\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe6\\x96*\\xe0\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\x13\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xebXF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xe5\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xc8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xe8\\xe4\\x96*" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb62000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x14\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x13\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00KdF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe8\\x96*\\xe0\\x00\\x00\\x00h\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x88\\xe8\\x96*" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe6\\x96*\\xe0\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\x14\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\x12\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xebXF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xe5\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xc8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xe8\\xe4\\x96*" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000028c" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x14\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x14\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00KdF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe8\\x96*\\xe0\\x00\\x00\\x00h\\xe8\\x96*\\xe0\\x00\\x00\\x00\\x88\\xe8\\x96*" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe6\\x96*\\xe0\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x12\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xebXF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xe5\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xc8\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xe8\\xe4\\x96*" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12048", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12048", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x240fdb20b50" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12048", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12048", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb63000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12048", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb65000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\x11\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x12\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xbb\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00[ZF5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xe6\\x96*\\xe0\\x00\\x00\\x00\\xa8\\xe6\\x96*\\xe0\\x00\\x00\\x00x\\xe6\\x96*\\xe0\\x00\\x00\\x00\\x98\\xe6\\x96*" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x13\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe4\\x96*\\xe0\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\x13\\xb6\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\xbc\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xfb^F5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x10\\xe3\\x96*\\xe0\\x00\\x00\\x00\\x08\\xe3\\x96*\\xe0\\x00\\x00\\x00\\xd8\\xe2\\x96*\\xe0\\x00\\x00\\x00\\xf8\\xe2\\x96*" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x12\\xb6\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xe0\\x96*\\xe0\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cf2480", "parentcaller": "0x7ff652cf1938", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "11840", "caller": "0x7ff652cfb0df", "parentcaller": "0x7ff652cf1979", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb67000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xe7\\xc1\\x19\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x04\\x00\\x00\\x00#\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb68000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5857433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585743bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff58568ae1", "parentcaller": "0x7fff58557ab3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff584f1e2e", "parentcaller": "0x7fff58557a49", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7ff652cf1d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7ff652cf1d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:45:20,947", "thread_id": "12052", "caller": "0x7ff652cf1d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthAgent" }, { "name": "DllBase", "value": "0x7fff18110000" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7ff652cf1d7f", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthAgent.dll" }, { "name": "BaseAddress", "value": "0x7fff18110000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7ff652cf1d7f", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "08728914-3F57-4D52-9E31-49DAECA5A80A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xb8\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00`\\xb9\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Security Health Agent Proxy Stub Factory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 361 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xb6\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xf0\\xb7\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xb6\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xf0\\xb7\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xb5\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00 \\xb6\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Security Health Agent Proxy Stub Factory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 393 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xb3\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xb0\\xb4\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xb3\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xb0\\xb4\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer32" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ee" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xb2\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xf0\\xb3\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ee" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f2" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\Elevation" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002ee" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002ee" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ee" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f0" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H\\x9f\\xb3\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00l\\x00b\\x00t\\x00\\\\x00d\\x00a\\x00t\\x00a\\x00\\\\x00y\\x00a\\x00r\\x00a\\x00\\\\x00c\\x00a\\x00p\\x00e\\x00m\\x00o\\x00n\\x00.\\x00y\\x00a\\x00c\\x00\\x00\\x00" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\x9f\\xb3\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc5j\\x00\\x00\\xf0\\x00\\xb2\\xfd@\\x02\\x00\\x00\\xf0\\x00\\xb2\\xfd@\\x02\\x00\\x00`\\x00\\xb2\\xfd@\\x02\\x00\\x00`\\x00\\xb2\\xfd@\\x02\\x00\\x00\\x00\\xa0\\xb3\\xfd" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08\\x96\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x88\\xa1\\xb3\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00[:\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xc6\\x07+\\xe0\\x00\\x00\\x00\\xa8\\xc6\\x07+\\xe0\\x00\\x00\\x00x\\xc6\\x07+\\xe0\\x00\\x00\\x00\\x98\\xc6\\x07+" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xa1\\xb3\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc4\\x07+\\xe0\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\xa0\\xb3\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00t\\x00.\\x00" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\xa0\\xb3\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00r\\x00%\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00t\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x95\\xb6\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x08\\x94\\xb3\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xfb>\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x10\\xc3\\x07+\\xe0\\x00\\x00\\x00\\x08\\xc3\\x07+\\xe0\\x00\\x00\\x00\\xd8\\xc2\\x07+\\xe0\\x00\\x00\\x00\\xf8\\xc2\\x07+" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x94\\xb3\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xc0\\x07+\\xe0\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584e0e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5850c590" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff18116b19", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff18116b36", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff181137e7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff181170c5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff1811375a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff18114175", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff181136cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577ced78", "parentcaller": "0x7fff18117b5e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "MutexName", "value": "Local\\SM0:11836:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff18117b8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff181145b9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff181145b9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff181145b9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff181145b9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff18114267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff18114267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff18114297", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff18114267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthProxyStub" }, { "name": "DllBase", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff1814e56d", "parentcaller": "0x7fff1811f907", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "434AEC1C-8583-45EC-B88F-750D6F380BC3" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "DFD80D65-D501-43B2-A8FF-86617BD81EA7" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:45:20,963", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb71000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb72000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff58568ae1", "parentcaller": "0x7fff584f7545", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000310" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584f74a2", "parentcaller": "0x7fff584f67e6", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000310" }, { "name": "ObjectAttributesName", "value": "ActivatableClassId" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000314" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Xml.Dom.XmlDocument" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000318" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00X\\x00m\\x00l\\x00.\\x00D\\x00o\\x00m\\x00.\\x00X\\x00m\\x00l\\x00D\\x00o\\x00c\\x00u\\x00m\\x00e\\x00n\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0R\\x18\\xffff\\x7f\\x00\\x00\\xffb8\\xffcfR\\x18\\xffff\\x7f\\x00\\x00\\xffd0\\xff80\\xffb4\\xfffd@\\x02\\x00\\x00\\xfff8\\xff81R\\x18\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00@\\x02\\x00\\x00\\xffbbF\\xffd74c\\xffb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x00x\\xffc6\\x07+\\xffe0\\x00\\x00\\x00+D\\xffd74c\\xffb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00_\\xffb5\\xfffd@\\x02\\x00\\x00\\xff90\\xffa3\\x15\\x18\\xffff\\x7f\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00@\\xffb6\\xffb4\\xfffd@\\x02\\x00\\x00\\xffc0\\xffc6\\x07+\\xffe0\\x00\\x00\\x00\\xffe4I0\\x18\\xffff\\x7f\\x00\\x00\\xff90\\xffa3\\x15\\x18\\xffff\\x7f\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0R\\x18\\xffff\\x7f\\x00\\x00\\xffb8\\xffcfR\\x18\\xffff\\x7f\\x00\\x00@\\xffb6\\xffb4\\xfffd@\\x02\\x00\\x00\\xfff8\\xff81R\\x18\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00@\\x02\\x00\\x00h\\xffd0R\\x18\\xffff\\x7f\\x00\\x00\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0R\\x18\\xffff\\x7f\\x00\\x00\\xffb0\\xffc6\\x07+\\xffe0\\x00\\x00\\x00\\xff98\\xff85R\\x18\\xffff\\x7f\\x00\\x00\\xffc0\\xffc6\\x07+\\xffe0\\x00\\x00\\x00P\\xffaf\\xffb4\\xfffd@\\x02\\x00\\x00\\xffb0tOX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x00@\\xffc8\\x07+\\xffe0\\x00\\x00\\x00@\\xffb6\\xffb4\\xfffd@\\x02\\x00\\x00\\x00_\\xffb5\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00l\\xffaf\\xffb4\\xfffd@\\x02\\x00\\x000\\x00\\x00\\x00@\\x02\\x00\\x00\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffc6\\x07+\\xffe0\\x00\\x00\\x00@\\x00\\x00\\x00\\xffe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffb6\\xffb4\\xfffd@\\x02\\x00\\x00\\x19hOX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000318" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\CustomAttributes" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff58577dd4", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "BaseAddress", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52b60000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52b6be70" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52b6bde0" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52be6480" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe66000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe69000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59fccc72", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59fccca1", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002f8" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59fcccb7", "parentcaller": "0x7fff59f938c0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f948aa", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffd70000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f94901", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffd70000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe6b000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc18a2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffd71000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e46f", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081010000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e4f0", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081010000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081012000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081013000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081015000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081017000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081019000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff52c10873", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000031c" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff52c108bb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52c108fe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cdb75", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081020000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081021000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081023000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081028000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff1814f202", "parentcaller": "0x7fff1813d644", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x240ffa308a8", "arguments": [ { "name": "Module", "value": "0x7fff18110000" }, { "name": "Type", "value": "#6" }, { "name": "Name", "value": "#688" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff1814f2ba", "parentcaller": "0x7fff1814f25c", "category": "misc", "api": "LoadResource", "status": true, "return": "0x240ffa35734", "arguments": [ { "name": "Module", "value": "0x7fff18110000" }, { "name": "ResourceInfo", "value": "0x240ffa308a8" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff1814f34e", "parentcaller": "0x7fff1814f25c", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x00000164", "arguments": [ { "name": "ModuleHandle", "value": "0x7fff18110000" }, { "name": "ResourceInfo", "value": "0x240ffa308a8" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000314" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Notifications.ToastNotificationManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\xffb3\\xfffd@\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb2\\xfffd@\\x02\\x00\\x00\\xffb9\\xffc2\\x07+\\xffe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x1e\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\xffc4\\x02\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xff88\\xffcf\\xffb4\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x07+\\xffe0\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x00\\xffb0\\xffc4\\xffb4\\xfffd@\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffcf\\xffb4\\xfffd@\\x02\\x00\\x00\\xffb0\\xffc4\\xffb4\\xfffd@\\x02\\x00\\x00\\xffb0\\x13\\xffb7\\xfffd@\\x02\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000\\xffd9\\xffb6\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0\\x13\\xffb7\\xfffd@\\x02\\x00\\x00\\x00_\\xffb5\\xfffd@\\x02\\x00\\x00\\x00_\\xffb5\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffc4\\xffb4\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xfff0\\xffaf\\xffb4\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc4\\x07+\\xffe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc4\\x07+\\xffe0\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0xe000000003" }, { "name": "DataLength", "value": "316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff585778a1", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000320" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff58577950", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xc6\\x07+\\xe0\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\xff\\xff\\xff\\xf8\\x81R\\x18\\xff\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0R\\x18\\xff\\x7f\\x00\\x00\\xa8\\xc7\\x07+\\xe0\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x02\\x81W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:45:20,978", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff585778d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "BaseAddress", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff40fb0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fc7a60" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fc7d00" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fcb840" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000314" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Notifications.ToastNotification" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xfff4\\xffb6\\xfffd@\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb2\\xfffd@\\x02\\x00\\x00\\xffb9\\xffc2\\x07+\\xffe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x1e\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\xffc4\\x02\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffaa\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00X\\x7f\\xffb7\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc3\\x07+\\xffe0\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x000\\xffd4\\xffb6\\xfffd@\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x7f\\xffb7\\xfffd@\\x02\\x00\\x000\\xffd4\\xffb6\\xfffd@\\x02\\x00\\x00@\\xffa7\\xffb7\\xfffd@\\x02\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffaa\\xfffd@\\x02\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x000\\xffd2\\xffb6\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff@\\xffa7\\xffb7\\xfffd@\\x02\\x00\\x00\\xffd0\\xffb8\\xffb7\\xfffd@\\x02\\x00\\x00\\xffd0\\xffb8\\xffb7\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffd4\\xffb6\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00@\\x02\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\x10\\x1a\\xffb7\\xfffd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc4\\x07+\\xffe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc4\\x07+\\xffe0\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000035c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\CustomAttributes" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0xe000000003" }, { "name": "DataLength", "value": "316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000035c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000360" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc06\\xb7\\xfd@\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xe86\\xb7\\xfd@\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x087\\xb7\\xfd@\\x02\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00>\\xb7\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00@\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "usermgrcli.dll" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000035c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59fafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000360" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000035c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000360" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00016000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff524a3000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\usermgrcli" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "InitRoutine", "value": "0x7fff52494250" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb7d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xa8\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xf0\\xa9\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:45:20,994", "thread_id": "12052", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Push Notification Platform" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xa7\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\x80\\xa8\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xa7\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\x80\\xa8\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 652 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000dc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000368" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000dc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5854f195", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000368" }, { "name": "ValueName", "value": "WaitForRestore" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5854f195", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 657 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000dc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000368" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000dc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5854ca47", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000368" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5854ca47", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb7e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb7f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb80000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000035e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\x98\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\xd0\\x99\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000035e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\x97\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00`\\x98\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\x97\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00`\\x98\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\x95\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00\\x90\\x96\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000035e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x94\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00 \\x95\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x94\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00 \\x95\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\x93\\x07+\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x00\\x00\\x00`\\x94\\x07+\\xe0\\x00\\x00\\x00" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036a" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000035e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000035e" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035e" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff50870000" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff50870000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff50886540" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff508865f0" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb82000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59767be3", "parentcaller": "0x7fff597a15ab", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" }, { "name": "Handle", "value": "0x0000035a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000035a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035a" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb88000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:45:21,010", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb8a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff1814e56d", "parentcaller": "0x7fff1813eeb5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F53321FA-34F8-4B7F-B9A3-361877CB94CF" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6BFF4732-81EC-4FFB-AE67-B6C1BC29631F" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000368" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\xf3\\xb7\\xfd@\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xf3\\xb7\\xfd@\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xf3\\xb7\\xfd@\\x02\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " 9\\xb7\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00@\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb8c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb8d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff40fca458", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd1c1e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca30a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca36e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd1329", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd17ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca41b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577ced78", "parentcaller": "0x7fff40fc4988", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "MutexName", "value": "Local\\SM0:11836:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fd1504", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff40fcb31b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408102d000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f59b1a", "parentcaller": "0x7fff59f7095c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081026000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081026000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f59b1a", "parentcaller": "0x7fff59f7095c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081023000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000037c" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\xa1\\xb8\\xfd@\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x008\\xa1\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xa1\\xb8\\xfd@\\x02\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbad54", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80<\\xb7\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff40fbb737", "parentcaller": "0x7fff40fd9f40", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff40fe6b78", "parentcaller": "0x7fff40fbb8b1", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "3", "pretty_value": "FILE_OPEN_IF" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" }, { "name": "Handle", "value": "0x00000382" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000382" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000386" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000382" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb8f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}" }, { "name": "Handle", "value": "0x0000035a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000035a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035a" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 10:45:21,025", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000380" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000384" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\xa7\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00e\\x00l\\x006\\x004\\x00 \\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00 \\x006\\x00 \\x00M\\x00o\\x00d\\x00e\\x00l\\x00 \\x009\\x004\\x00 \\x00S\\x00t\\x00e\\x00" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xa4\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00R\\x00=\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00T\\x00O\\x00P\\x00-\\x007\\x004\\x00S\\x00U\\x00V\\x008\\x00W\\x00\\x00\\x00N\\x00U\\x00M\\x00B\\x00E\\x00R\\x00_\\x00O\\x00F\\x00_\\x00P\\x00R\\x00O\\x00C\\x00E\\x00S\\x00" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88;\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xa7\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xbb\\x19\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xa6\\x07+\\xe0\\x00\\x00\\x00H\\xa6\\x07+\\xe0\\x00\\x00\\x00\\x18\\xa6\\x07+\\xe0\\x00\\x00\\x008\\xa6\\x07+" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xa7\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xa4\\x07+\\xe0\\x00\\x00\\x00\\x84\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xa3\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00t\\x00a\\x00\\x00\\x00H\\x00O\\x00M\\x00E\\x00D\\x00R\\x00I\\x00V\\x00E\\x00=\\x00C\\x00:\\x00\\x00\\x00H\\x00O\\x00M\\x00E\\x00P\\x00A\\x00T\\x00H\\x00=\\x00\\\\x00" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xa1\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00o\\x00g\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00l\\x00e\\x00s\\x00\\\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\x00\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00P\\x00r\\x00o\\x00g\\x00r\\x00" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe88\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xa2\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00[\\x1e\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xa2\\x07+\\xe0\\x00\\x00\\x00\\xa8\\xa2\\x07+\\xe0\\x00\\x00\\x00x\\xa2\\x07+\\xe0\\x00\\x00\\x00\\x98\\xa2\\x07+" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa2\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xa0\\x07+\\xe0\\x00\\x00\\x00\\x84\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}" }, { "name": "Handle", "value": "0x00000386" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000386" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000382" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000382" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000382" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000384" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xa6\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00S\\x00S\\x00O\\x00R\\x00_\\x00A\\x00R\\x00C\\x00H\\x00I\\x00T\\x00E\\x00C\\x00T\\x00U\\x00R\\x00E\\x00=\\x00A\\x00M\\x00D\\x006\\x004\\x00\\x00\\x00P\\x00R\\x00" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xa4\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00i\\x00v\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00O\\x00n\\x00e\\x00D\\x00r\\x00i\\x00v\\x00e\\x00\\x00\\x00O\\x00S\\x00=\\x00W\\x00i\\x00n\\x00d\\x00o\\x00" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h7\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xa1\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xbb\\x19\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xa6\\x07+\\xe0\\x00\\x00\\x00H\\xa6\\x07+\\xe0\\x00\\x00\\x00\\x18\\xa6\\x07+\\xe0\\x00\\x00\\x008\\xa6\\x07+" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xa4\\x07+\\xe0\\x00\\x00\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xa1\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00l\\x00e\\x00s\\x00\\\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\x00\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00P\\x00" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xa7\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(8\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xa2\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00[\\x1e\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xa2\\x07+\\xe0\\x00\\x00\\x00\\xa8\\xa2\\x07+\\xe0\\x00\\x00\\x00x\\xa2\\x07+\\xe0\\x00\\x00\\x00\\x98\\xa2\\x07+" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa2\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xa0\\x07+\\xe0\\x00\\x00\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}" }, { "name": "Handle", "value": "0x0000037a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000037e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037e" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000037c" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xa5\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00;\\x00C\\x00:\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xa2\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(>\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xa3\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x8b\\x1b\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00`\\xa8\\x07+\\xe0\\x00\\x00\\x00X\\xa8\\x07+\\xe0\\x00\\x00\\x00(\\xa8\\x07+\\xe0\\x00\\x00\\x00H\\xa8\\x07+" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xa3\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xa6\\x07+\\xe0\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\xa1\\xb8\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xa4\\xb8\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00L\\x00A\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00=\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc87\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xa5\\xb8\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00+\\x18\\xd74c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xc0\\xa4\\x07+\\xe0\\x00\\x00\\x00\\xb8\\xa4\\x07+\\xe0\\x00\\x00\\x00\\x88\\xa4\\x07+\\xe0\\x00\\x00\\x00\\xa8\\xa4\\x07+" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa5\\xb8\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xa2\\x07+\\xe0\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb91000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb94000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12048", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xf1\\xc5\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00k\\xd3\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12048", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x240fdb20b50" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000390" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb95000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{0000000C-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000396" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0000000C-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000396" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000039a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039a" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000396" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb96000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000394" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000398" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc87\\xb9\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x107\\xb9\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf87\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h7\\xb9\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00K9\\xdf4c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xc5\\x0f+\\xe0\\x00\\x00\\x00\\x98\\xc5\\x0f+\\xe0\\x00\\x00\\x00h\\xc5\\x0f+\\xe0\\x00\\x00\\x00\\x88\\xc5\\x0f+" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`7\\xb9\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xc3\\x0f+\\xe0\\x00\\x00\\x00\\x98\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x888\\xb9\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf08\\xb9\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8:\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "(8\\xb9\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xeb=\\xdf4c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xc2\\x0f+\\xe0\\x00\\x00\\x00\\xf8\\xc1\\x0f+\\xe0\\x00\\x00\\x00\\xc8\\xc1\\x0f+\\xe0\\x00\\x00\\x00\\xe8\\xc1\\x0f+" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 8\\xb9\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xbf\\x0f+\\xe0\\x00\\x00\\x00\\x98\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb99000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}" }, { "name": "Handle", "value": "0x00000372" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000372" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000372" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12052", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 10:45:21,041", "thread_id": "12048", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026a" }, { "name": "SubKey", "value": "Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}" }, { "name": "Handle", "value": "0x0000039a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000039a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000396" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000396" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000396" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000039a" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000398" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000394" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H\\x91\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x002\\x00=\\x00C\\x00:\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00\\\\x00C\\x00o\\x00m\\x00m\\x00o\\x00n\\x00 \\x00" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10\\x92\\xb4\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00m\\x00d\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00r\\x00i\\x00v\\x00e\\x00r\\x00D\\x00a\\x00t\\x00a\\x00=\\x00C\\x00:\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x00" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb88\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\x92\\xb4\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00[C/5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xcf\\xff*\\xe0\\x00\\x00\\x00\\xa8\\xcf\\xff*\\xe0\\x00\\x00\\x00x\\xcf\\xff*\\xe0\\x00\\x00\\x00\\x98\\xcf\\xff*" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x92\\xb4\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xcd\\xff*\\xe0\\x00\\x00\\x00\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "`\\xbc\\x19\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8\\x92\\xb4\\xfd@\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00T\\x00A\\x00=\\x00C\\x00:\\x00\\\\x00U\\x00s\\x00e\\x00r\\x00s\\x00\\\\x00a\\x00d\\x00m\\x00i\\x00n\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\x93\\xb4\\xfd@\\x02\\x00\\x00`\\x00\\x00\\x00R\\x00=\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00T\\x00O\\x00P\\x00-\\x007\\x004\\x00S\\x00U\\x00V\\x008\\x00W\\x00\\x00\\x00N\\x00U\\x00M\\x00B\\x00E\\x00R\\x00_\\x00O\\x00F\\x00_\\x00P\\x00R\\x00O\\x00C\\x00E\\x00S\\x00" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X8\\xb7\\xfd@\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "(\\x90\\xb4\\xfd@\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xfbG/5c\\xb8\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x10\\xcc\\xff*\\xe0\\x00\\x00\\x00\\x08\\xcc\\xff*\\xe0\\x00\\x00\\x00\\xd8\\xcb\\xff*\\xe0\\x00\\x00\\x00\\xf8\\xcb\\xff*" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x90\\xb4\\xfd@\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xc9\\xff*\\xe0\\x00\\x00\\x00\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000398" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12048", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000394" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb9c000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12144", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12144", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x240fdb20b50" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b836a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b6b295", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b836a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff1811c307", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb51000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb5b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb88000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ff4d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023e" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnregisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fceec0" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnsubscribeWnfNotificationWaitForCompletion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb2650" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "12052", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55410000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff517c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff40fb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnregisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fceec0" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnsubscribeWnfNotificationWaitForCompletion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb2650" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthAgent" }, { "name": "DllBase", "value": "0x7fff18110000" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffa30000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff18110000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthProxyStub" }, { "name": "DllBase", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4c1e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240fdb51000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3fd40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff50870000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081023000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081022000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe65000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101c000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe6b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe63000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe65000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101c000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081022000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2408101c000" }, { "name": "RegionSize", "value": "0x00019000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe65000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe6b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe6b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081017000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081017000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffa20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe63000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe65000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffd70000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24081010000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ffe60000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52b60000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf19b5", "parentcaller": "0x7ff652cf1c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf1cee", "parentcaller": "0x7ff652cfd52c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf4b1b", "parentcaller": "0x7ff652cfee4f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf8d39", "parentcaller": "0x7ff652cfed95", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cf523f", "parentcaller": "0x7ff652cf8e5e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfed67", "parentcaller": "0x7ff652cfd593", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff55510000" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff55510000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff55510000" }, { "name": "FunctionName", "value": "AppPolicyGetProcessTerminationMethod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff555130e0" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x7fff57d1d3a0" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x240ff4e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 10:45:21,056", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000090" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000008c" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000084" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000013c" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e4" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c0" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000bc" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b8" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000288" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000288" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000288" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000288" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ac" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a4" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000064" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000044" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000005c" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000060" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 10:45:21,072", "thread_id": "11840", "caller": "0x7ff652cfd593", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1232 } ], "threads": [ "11840", "11960", "11956", "11968", "12044", "12048", "12052", "12140", "12144" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff652cf0000", "MainExeSize": "0x0001a000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 9388, "process_name": "svchost.exe", "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-29 10:45:22,353", "calls": [ { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7fff5a023ddb", "parentcaller": "0x7fff59fc4dbb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000000c" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff7bf225080" }, { "name": "Parameter", "value": "0xea5b15c000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11644", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8232000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11644", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000040" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 4 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11664", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11664", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11644", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11644", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11660", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8305000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11660", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11660", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18342030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "2280", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "2280", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2250ea", "parentcaller": "0x7ff7bf225046", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2c0e8203908", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf221634", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "54" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf221647", "parentcaller": "0x7ff7bf2215e9", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff7bf2262b0" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2216b2", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2216eb", "parentcaller": "0x7ff7bf2215e9", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2c0e8203908", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22176f", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "82" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00[\\x00W\\x00e\\x00r\\x00S\\x00v\\x00c\\x00G\\x00r\\x00o\\x00u\\x00p\\x00]\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22179c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" }, { "name": "Handle", "value": "0x00000220" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf221aea", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "ValueName", "value": "WerSvcGroup" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf221b63", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "ValueName", "value": "WerSvcGroup" }, { "name": "Data", "value": "\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf221bc6", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000220" }, { "name": "SubKey", "value": "WerSvcGroup" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22230b", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Control\\SCMConfig" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SCMConfig" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22233f", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "EnableSvchostMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\EnableSvchostMitigationPolicy" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf222358", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22246b", "parentcaller": "0x7ff7bf2217b6", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\PerfTrack\\TraceProfile" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\PerfTrack\\TraceProfile" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2217c4", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2254be", "parentcaller": "0x7ff7bf2226de", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "52" }, { "name": "ProcessInformation", "value": "\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2227ec", "parentcaller": "0x7ff7bf2218af", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8e26000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf222933", "parentcaller": "0x7ff7bf222837", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Control\\SCMConfig" }, { "name": "Handle", "value": "0x00000230" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SCMConfig" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf222973", "parentcaller": "0x7ff7bf222837", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000230" }, { "name": "ValueName", "value": "SvchostHeapReportingThresholdInKB" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\SvchostHeapReportingThresholdInKB" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf22298c", "parentcaller": "0x7ff7bf222837", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegOpenKeyExA", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000234" }, { "name": "SubKey", "value": "wersvc" }, { "name": "Handle", "value": "0x00000230" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\wersvc" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000230" }, { "name": "ValueName", "value": "Alias" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Alias" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000048" }, { "name": "TokenHandle", "value": "0x00000234" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "2" }, { "name": "TokenInformation", "value": "\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x8a \\xe8\\xc0\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x0f\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x94\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x8a \\xe8\\xc0\\x02\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x06\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x01\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "services", "api": "OpenSCManagerA", "status": true, "return": "0x2c0e8232440", "arguments": [ { "name": "MachineName", "value": "" }, { "name": "DatabaseName", "value": "" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "SC_MANAGER_CONNECT" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8227000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8228000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8229000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000000c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000021c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff5992dfb0" }, { "name": "Parameter", "value": "0x2c0e821c920" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "11720" }, { "name": "ProcessId", "value": "9388" }, { "name": "Module", "value": "sechost.dll" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000021c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff5992dfb0" }, { "name": "Parameter", "value": "0x2c0e821c920" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "11720" }, { "name": "ProcessId", "value": "9388" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000021c" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "11720" }, { "name": "ProcessId", "value": "9388" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000000c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e822a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff5992dfb0" }, { "name": "Parameter", "value": "0x2c0e821c920" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf2237c0", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services" }, { "name": "Handle", "value": "0x0000023c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf2237ed", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000023c" }, { "name": "SubKey", "value": "wersvc" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\wersvc" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf22381e", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000238" }, { "name": "SubKey", "value": "Parameters" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf223847", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf22385d", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf2238c6", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "ServiceDll" }, { "name": "Data", "value": "%SystemRoot%\\System32\\WerSvc.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDll" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf223977", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "ServiceManifest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceManifest" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:45:22,416", "thread_id": "11720", "caller": "0x7ff7bf223b37", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "ServiceMain" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceMain" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\WindowsPerformanceRecorderControl" }, { "name": "DllBase", "value": "0x7fff3e0f0000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\WerEtw" }, { "name": "DllBase", "value": "0x7fff17190000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\wersvc" }, { "name": "DllBase", "value": "0x7fff171d0000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wersvc.dll" }, { "name": "BaseAddress", "value": "0x7fff171d0000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff171d0000", "arguments": [ { "name": "lpLibFileName", "value": "c:\\windows\\system32\\wersvc.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224dba", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WLDP" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224dba", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "WLDP.DLL" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224dba", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff56fa0000", "arguments": [ { "name": "lpLibFileName", "value": "WLDP.DLL" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224ddc", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WLDP.DLL" }, { "name": "ModuleHandle", "value": "0x7fff56fa0000" }, { "name": "FunctionName", "value": "WldpIsAllowedEntryPoint" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff56fb4040" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223c35", "parentcaller": "0x7ff7bf224126", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223c5d", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "ModuleHandle", "value": "0x7fff171d0000" }, { "name": "FunctionName", "value": "ServiceMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff171e9290" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223d35", "parentcaller": "0x7ff7bf224126", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223d59", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "ModuleHandle", "value": "0x7fff171d0000" }, { "name": "FunctionName", "value": "SvchostPushServiceGlobalsEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223e31", "parentcaller": "0x7ff7bf224126", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223e55", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "ModuleHandle", "value": "0x7fff171d0000" }, { "name": "FunctionName", "value": "SvchostPushServiceGlobals" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff171e93d0" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf223e8b", "parentcaller": "0x7ff7bf224126", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf2241cb", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services" }, { "name": "Handle", "value": "0x0000025c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf2241f8", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000025c" }, { "name": "SubKey", "value": "wersvc" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\wersvc" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf22422a", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000240" }, { "name": "SubKey", "value": "Parameters" }, { "name": "Handle", "value": "0x00000260" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224253", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224269", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf2242a6", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "ValueName", "value": "LegacyCOMBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\LegacyCOMBehavior" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf2242bf", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "54" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000240" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e822d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "services", "api": "OpenSCManagerW", "status": true, "return": "0x2c0e8234210", "arguments": [ { "name": "MachineName", "value": "" }, { "name": "DatabaseName", "value": "" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SC_MANAGER_ENUMERATE_SERVICE" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "services", "api": "OpenServiceW", "status": true, "return": "0x2c0e82342d0", "arguments": [ { "name": "ServiceControlManager", "value": "0x2c0e8234210" }, { "name": "ServiceName", "value": "WerSvc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "SERVICE_QUERY_CONFIG" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e822e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000274" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000274" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" }, { "name": "ValueName", "value": "ServiceTimeout" }, { "name": "Data", "value": "60000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ServiceTimeout" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" }, { "name": "EventName", "value": "\\KernelObjects\\SystemErrorPortReady" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff171f7620" }, { "name": "Parameter", "value": "0x7fff1720e3f0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "3700" }, { "name": "ProcessId", "value": "9388" }, { "name": "Module", "value": "wersvc.dll" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000280", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff171f7620" }, { "name": "Parameter", "value": "0x7fff1720e3f0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3700" }, { "name": "ProcessId", "value": "9388" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "3700", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8238000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8306000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" }, { "name": "EventName", "value": "WerSvcSystemPermissionsEvent" }, { "name": "EventType", "value": "1" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "3700", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "3700", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff171f7620" }, { "name": "Parameter", "value": "0x7fff1720e3f0" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff171e4590" }, { "name": "Parameter", "value": "0x7fff1720e3a0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "4832" }, { "name": "ProcessId", "value": "9388" }, { "name": "Module", "value": "wersvc.dll" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000298", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff171e4590" }, { "name": "Parameter", "value": "0x7fff1720e3a0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4832" }, { "name": "ProcessId", "value": "9388" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "4832", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000040" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 120 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11720", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "4832", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "4832", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff171e4590" }, { "name": "Parameter", "value": "0x7fff1720e3a0" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11728", "caller": "0x7fff171e4d05", "parentcaller": "0x7fff171e4c19", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:45:22,431", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff171ececc", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wer" }, { "name": "DllBase", "value": "0x7fff55330000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff171ececc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wer.dll" }, { "name": "BaseAddress", "value": "0x7fff55330000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff171ececc", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff55330000", "arguments": [ { "name": "lpLibFileName", "value": "wer.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff171ecf10", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wer.dll" }, { "name": "ModuleHandle", "value": "0x7fff55330000" }, { "name": "FunctionName", "value": "WerpCreateMachineStore" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5538b410" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f56861", "parentcaller": "0x7fff59f5678c", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00200000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea202000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea203000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xeb\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00H\\xec\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000210" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000210" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000210" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000210" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000210" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea213000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea214000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000020c" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000020c" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000020c" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000270" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e824b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000210" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:45:22,447", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000208" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000020c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000210" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002bc" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c0" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x000002b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000240" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000260" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff55351fa5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c58a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c835", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002c8" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c986", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00160080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002b0" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237360", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237830", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82378a0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bd092", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002c4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002c4" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237de0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237050", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82376e0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5540a000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5540a000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:45:22,463", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f64485", "parentcaller": "0x7fff59fbb2bd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f29032", "parentcaller": "0x7fff57f085a4", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f29065", "parentcaller": "0x7fff57f085a4", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a0" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f29099", "parentcaller": "0x7fff57f085a4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08a04", "parentcaller": "0x7fff57f08885", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08a42", "parentcaller": "0x7fff57f08885", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a0" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08b03", "parentcaller": "0x7fff57f08885", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08b43", "parentcaller": "0x7fff57f08885", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000270" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08be5", "parentcaller": "0x7fff57f08885", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a0" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08c3b", "parentcaller": "0x7fff57f08885", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f08c51", "parentcaller": "0x7fff57f08885", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f088f1", "parentcaller": "0x7fff57f085fd", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57f0f1bc", "parentcaller": "0x7fff57f0f0ce", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff57f0f10d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000270" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xe4\\x1dV\\xbd9p\\xb9a+\\xf6\\x04\\xe1Y\\xdeS\\xb8\\x06\\x1d\\xe6\\x8f\\xbe\\xae@\\xa2\\x12\\xbd\\xa0_\\xb8\\x17g\\x92\\xcfQ\\xcd\\x8a\\x0b_l\\x7f+`\\xd7\\x98\\xa4\\x0bG\\xc6" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff57f0f10d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553c0692", "parentcaller": "0x7fff5539ca1b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0xc0010000", "pretty_value": "GENERIC_READ|GENERIC_WRITE|DELETE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\a6e4fa08-0880-4e40-b09b-bb389c339c38" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553c0731", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff553beeac", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x0009c040" }, { "name": "InBuffer", "value": "\\x01\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bef2a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea215000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xeb\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00H\\xec\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000208" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000208" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea216000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000208" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000208" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000208" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000208" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002b0" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000208" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002b0" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002cc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002cc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:45:22,478", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x0000020c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000020c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000260" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000260" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000208" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000208" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000208" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000208" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea205000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e824c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff55351fa5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c58a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c835", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c986", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00160080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237830", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237c20", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82376e0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bd092", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00o\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237c90", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82373d0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237c90", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:45:22,494", "thread_id": "11728", "caller": "0x7fff553c0692", "parentcaller": "0x7fff5539ca1b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0xc0010000", "pretty_value": "GENERIC_READ|GENERIC_WRITE|DELETE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\28c4bba8-9b4d-4ecd-9f53-ce7a8d27701a" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553c0731", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff553beeac", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002d0" }, { "name": "IoControlCode", "value": "0x0009c040" }, { "name": "InBuffer", "value": "\\x01\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bef2a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553966cc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff5537223f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff553723d7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59f552cc", "parentcaller": "0x7fff59f708df", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59f5480c", "parentcaller": "0x7fff59f55363", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00200000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff59fa0356", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff5537c7a2", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5537c76b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5537c76b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wer" }, { "name": "DllBase", "value": "0x7fff55330000" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55330000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171dcc45", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\lpw_albt\\bin\\PPLinject64.exe" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171dccbd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171e191d", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000450", "pretty_value": "PROCESS_VM_READ|PROCESS_DUP_HANDLE|PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\lpw_albt\\bin\\PPLinject64.exe" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff171e19b5", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x000002a4" }, { "name": "SourceHandle", "value": "0x0000011c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea100000" }, { "name": "SectionOffset", "value": "0xea5bbfef10" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e1c47", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e1c5b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff171e1c87", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171e8902", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\lpw_albt\\bin\\PPLinject64.exe" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e89a1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171e8a42", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00001040", "pretty_value": "PROCESS_DUP_HANDLE|PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\lpw_albt\\bin\\PPLinject64.exe" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff171e8aa2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x000002a4" }, { "name": "SourceHandle", "value": "0x0000011c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b0" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d8" }, { "name": "ThreadHandle", "value": "0x000002d0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\WerFault.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\WerFault.exe -pss -s 688 -p 8756 -ip 8756" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "2104" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff557b6e6d", "parentcaller": "0x7fff557b6662", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 942 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff57fcbbe4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\WerFault.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\WerFault.exe -pss -s 688 -p 8756 -ip 8756" }, { "name": "CreationFlags", "value": "0x00000400", "pretty_value": "CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "2104" }, { "name": "ThreadId", "value": "2156" }, { "name": "ProcessHandle", "value": "0x000002d8" }, { "name": "ThreadHandle", "value": "0x000002d0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 944 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e8c22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 10:45:22,510", "thread_id": "11728", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff171e8c9b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e8d1a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e8d35", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e8d50", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171e90e1", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00000050", "pretty_value": "PROCESS_VM_READ|PROCESS_DUP_HANDLE" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\Windows\\system32\\WerFault.exe" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff171e9168", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0x000002d0" }, { "name": "SourceHandle", "value": "0x0000011c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea110000" }, { "name": "SectionOffset", "value": "0xea5bbfeec0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e923e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e9252", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5780eb53", "parentcaller": "0x7fff171e9266", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea110000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171ebb10", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x001fffff", "pretty_value": "PROCESS_ALL_ACCESS" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\Windows\\system32\\WerFault.exe" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff171ebd4c", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x001fffff", "pretty_value": "PROCESS_ALL_ACCESS" }, { "name": "ProcessIdentifier", "value": "8756" }, { "name": "ProcessName", "value": "C:\\Windows\\system32\\WerFault.exe" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "faultrep.dll" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\Faultrep.dll" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Faultrep.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Faultrep.dll" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff46350000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0007b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff463b5000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639c000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639c000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639c000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639c000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639b000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "dbghelp.dll" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dbghelp.dll" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dbghelp.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dbghelp.dll" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47530000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x001e4000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770a000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "dbgcore.DLL" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47699000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\dbgcore.dll" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dbgcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000031c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dbgcore.dll" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff474f0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00034000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4639b000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97fe1", "parentcaller": "0x7fff59f97bdd", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47513000" }, { "name": "ModuleName", "value": "dbgcore.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\dbghelp" }, { "name": "DllBase", "value": "0x7fff47530000" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\dbgcore" }, { "name": "DllBase", "value": "0x7fff474f0000" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\faultrep" }, { "name": "DllBase", "value": "0x7fff46350000" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff4753125f", "parentcaller": "0x7fff57c7e473", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e825d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e825e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e825f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8260000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5780c976", "parentcaller": "0x7fff475481dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8261000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff47548089", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTempPathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57814af0" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp" }, { "name": "BaseAddress", "value": "0x7fff47530000" }, { "name": "InitRoutine", "value": "0x7fff4754b1a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbgcore" }, { "name": "BaseAddress", "value": "0x7fff474f0000" }, { "name": "InitRoutine", "value": "0x7fff47511070" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\Faultrep" }, { "name": "BaseAddress", "value": "0x7fff46350000" }, { "name": "InitRoutine", "value": "0x7fff46396140" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff46389aad", "parentcaller": "0x7fff4635e0bf", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x000002e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff46389afb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "ValueName", "value": "NoReflection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoReflection" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff46389b38", "parentcaller": "0x7fff4635e0bf", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff46389aad", "parentcaller": "0x7fff4635e0e0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "wer.dll" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wer.dll" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wer.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000031c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002e0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wer.dll" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000031c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55330000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000de000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5540a000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d7000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d7000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d7000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d7000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d6000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff553d6000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\wer" }, { "name": "DllBase", "value": "0x7fff55330000" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5537227d", "parentcaller": "0x7fff553818ff", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x2c0e8e28000", "arguments": [ { "name": "Options", "value": "0" }, { "name": "InitialSize", "value": "0x00000000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5537227d", "parentcaller": "0x7fff553818ff", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wer" }, { "name": "BaseAddress", "value": "0x7fff55330000" }, { "name": "InitRoutine", "value": "0x7fff553817c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff463b5000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff463b5000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f56861", "parentcaller": "0x7fff59f5678c", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00200000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea202000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea203000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc0\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x98\\xc1\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea213000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea214000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000032c" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 10:45:22,603", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000032c" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8264000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000330" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000210" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000032c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-29 10:45:22,619", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000224" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000224" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000224" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000224" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000224" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff55351fa5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c58a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c835", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000224" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c986", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x00160080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000224" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237ad0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237280", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237de0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bd092", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000224" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237280", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5540a000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5540a000" }, { "name": "ModuleName", "value": "wer.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553c0692", "parentcaller": "0x7fff5539ca1b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0xc0010000", "pretty_value": "GENERIC_READ|GENERIC_WRITE|DELETE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\0d5844f8-11cb-4a90-804d-9eeed0bd5515" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553c0731", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff553beeac", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000328" }, { "name": "IoControlCode", "value": "0x0009c040" }, { "name": "InBuffer", "value": "\\x01\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bef2a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea215000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc0\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x98\\xc1\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000328" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000328" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea216000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000328" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000032c" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000032c" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff55351f36", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 10:45:22,635", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000032c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002dc" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000330" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000330" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002dc" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000330" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:45:22,650", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000032c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea205000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff55351fa5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c58a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c835", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00a\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5539c986", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00160080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|WRITE_DAC|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237670", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237980", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237600", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bd092", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00w\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "N\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82379f0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff55377daa", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff553c0692", "parentcaller": "0x7fff5539ca1b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0xc0010000", "pretty_value": "GENERIC_READ|GENERIC_WRITE|DELETE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c82e364e-9619-4e20-9837-f3d32208cbe0" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553c0731", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff553beeac", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002dc" }, { "name": "IoControlCode", "value": "0x0009c040" }, { "name": "InBuffer", "value": "\\x01\\x00" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553bef2a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff553966cc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5781026b", "parentcaller": "0x7fff46370140", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000004f" }, { "name": "TokenHandle", "value": "0x0000032c" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff46389aad", "parentcaller": "0x7fff4635d21d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4635d6dc", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4635d73a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\xc5\\xbf[\\xea\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00 \\xc7\\xbf[\\xea\\x00\\x00\\x00\\xad\\x9a8F\\xff\\x7f\\x00\\x00\\xfe\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00t\\x006\\x004\\x00.\\x00e\\x00x\\x00e\\x00 \\xc6\\xbf[" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "USERENV.dll" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\userenv.dll" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\userenv.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000334" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000330" }, { "name": "FileName", "value": "C:\\Windows\\System32\\userenv.dll" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000334" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57520000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0002e000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57549000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753d000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753d000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753d000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753d000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5753c000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\userenv" }, { "name": "BaseAddress", "value": "0x7fff57520000" }, { "name": "InitRoutine", "value": "0x7fff57524f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff463b5000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff463b5000" }, { "name": "ModuleName", "value": "faultrep.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "profapi.dll" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002dc" }, { "name": "FileName", "value": "C:\\Windows\\System32\\profapi.dll" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000204" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57560000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00025000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57577000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\profapi" }, { "name": "BaseAddress", "value": "0x7fff57560000" }, { "name": "InitRoutine", "value": "0x7fff575690e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57549000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57549000" }, { "name": "ModuleName", "value": "USERENV.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57564ea4", "parentcaller": "0x7fff57565158", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramData" }, { "name": "Data", "value": "%SystemDrive%\\ProgramData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57564eda", "parentcaller": "0x7fff57565158", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57564ea4", "parentcaller": "0x7fff57565190", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "Public" }, { "name": "Data", "value": "%SystemDrive%\\Users\\Public" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57564eda", "parentcaller": "0x7fff57565190", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff57564619", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Control\\Session Manager\\Environment" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575646ba", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000334" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "15" }, { "name": "MaxValueNameLength", "value": "22" }, { "name": "MaxValueLength", "value": "278" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8265000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "ComSpec" }, { "name": "Data", "value": "%SystemRoot%\\system32\\cmd.exe" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\ComSpec" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "DriverData" }, { "name": "Data", "value": "C:\\Windows\\System32\\Drivers\\DriverData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\DriverData" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "OS" }, { "name": "Data", "value": "Windows_NT" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\OS" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "Path" }, { "name": "Data", "value": "%SystemRoot%\\system32;%SystemRoot%;%SystemRoot%\\System32\\Wbem;%SYSTEMROOT%\\System32\\WindowsPowerShell\\v1.0\\;%SYSTEMROOT%\\System32\\OpenSSH\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\Path" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "4" }, { "name": "ValueName", "value": "PATHEXT" }, { "name": "Data", "value": ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PATHEXT" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "PROCESSOR_ARCHITECTURE" }, { "name": "Data", "value": "AMD64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "PSModulePath" }, { "name": "Data", "value": "%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PSModulePath" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "TEMP" }, { "name": "Data", "value": "%SystemRoot%\\TEMP" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\TEMP" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "TMP" }, { "name": "Data", "value": "%SystemRoot%\\TEMP" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\TMP" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "9" }, { "name": "ValueName", "value": "USERNAME" }, { "name": "Data", "value": "SYSTEM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\USERNAME" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "10" }, { "name": "ValueName", "value": "windir" }, { "name": "Data", "value": "%SystemRoot%" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\windir" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "11" }, { "name": "ValueName", "value": "NUMBER_OF_PROCESSORS" }, { "name": "Data", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\NUMBER_OF_PROCESSORS" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "12" }, { "name": "ValueName", "value": "PROCESSOR_LEVEL" }, { "name": "Data", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_LEVEL" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 10:45:22,666", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "13" }, { "name": "ValueName", "value": "PROCESSOR_IDENTIFIER" }, { "name": "Data", "value": "Intel64 Family 6 Model 94 Stepping 3, GenuineIntel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_IDENTIFIER" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "14" }, { "name": "ValueName", "value": "PROCESSOR_REVISION" }, { "name": "Data", "value": "5e03" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_REVISION" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "ComSpec" }, { "name": "Data", "value": "%SystemRoot%\\system32\\cmd.exe" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\ComSpec" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "DriverData" }, { "name": "Data", "value": "C:\\Windows\\System32\\Drivers\\DriverData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\DriverData" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "OS" }, { "name": "Data", "value": "Windows_NT" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\OS" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "Path" }, { "name": "Data", "value": "%SystemRoot%\\system32;%SystemRoot%;%SystemRoot%\\System32\\Wbem;%SYSTEMROOT%\\System32\\WindowsPowerShell\\v1.0\\;%SYSTEMROOT%\\System32\\OpenSSH\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\Path" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "4" }, { "name": "ValueName", "value": "PATHEXT" }, { "name": "Data", "value": ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PATHEXT" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "PROCESSOR_ARCHITECTURE" }, { "name": "Data", "value": "AMD64" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "PSModulePath" }, { "name": "Data", "value": "%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PSModulePath" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "TEMP" }, { "name": "Data", "value": "%SystemRoot%\\TEMP" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\TEMP" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577cc0f2", "parentcaller": "0x7fff57564b8f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc100", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "TMP" }, { "name": "Data", "value": "%SystemRoot%\\TEMP" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\TMP" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577cc0f2", "parentcaller": "0x7fff57564b8f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc100", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Temp" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "9" }, { "name": "ValueName", "value": "USERNAME" }, { "name": "Data", "value": "SYSTEM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\USERNAME" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "10" }, { "name": "ValueName", "value": "windir" }, { "name": "Data", "value": "%SystemRoot%" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\windir" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e824f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "11" }, { "name": "ValueName", "value": "NUMBER_OF_PROCESSORS" }, { "name": "Data", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\NUMBER_OF_PROCESSORS" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "12" }, { "name": "ValueName", "value": "PROCESSOR_LEVEL" }, { "name": "Data", "value": "6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_LEVEL" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "13" }, { "name": "ValueName", "value": "PROCESSOR_IDENTIFIER" }, { "name": "Data", "value": "Intel64 Family 6 Model 94 Stepping 3, GenuineIntel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_IDENTIFIER" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "Index", "value": "14" }, { "name": "ValueName", "value": "PROCESSOR_REVISION" }, { "name": "Data", "value": "5e03" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment\\PROCESSOR_REVISION" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564bb1", "parentcaller": "0x7fff57564112", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756412f", "parentcaller": "0x7fff57562680", "category": "misc", "api": "GetComputerNameExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564ea4", "parentcaller": "0x7fff57565174", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564ecc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "Default" }, { "name": "Data", "value": "%SystemDrive%\\Users\\Default" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564eda", "parentcaller": "0x7fff57565174", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramFilesDir" }, { "name": "Data", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonFilesDir" }, { "name": "Data", "value": "C:\\Program Files\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramFilesDir (x86)" }, { "name": "Data", "value": "C:\\Program Files (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonFilesDir (x86)" }, { "name": "Data", "value": "C:\\Program Files (x86)\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" }, { "name": "ValueName", "value": "ProgramW6432Dir" }, { "name": "Data", "value": "C:\\Program Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756433b", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff57564363", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "CommonW6432Dir" }, { "name": "Data", "value": "C:\\Program Files\\Common Files" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564371", "parentcaller": "0x7fff57562680", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff575660b2", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc9$\\xe8\\xc0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575630ec", "parentcaller": "0x7fff57562695", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564fef", "parentcaller": "0x7fff57563122", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756502d", "parentcaller": "0x7fff57563122", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575656b7", "parentcaller": "0x7fff575651bf", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff575657bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff575657bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564fef", "parentcaller": "0x7fff575658eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756502d", "parentcaller": "0x7fff575658eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575659df", "parentcaller": "0x7fff575659a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5781026b", "parentcaller": "0x7fff57565cb5", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002dc" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57565c30", "parentcaller": "0x7fff575650f5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575656b7", "parentcaller": "0x7fff575650b7", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000003", "pretty_value": "HKEY_USERS" }, { "name": "SubKey", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff575657bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff575657bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564fef", "parentcaller": "0x7fff575658eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566d14", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57566da0", "parentcaller": "0x7fff5756501f", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5756502d", "parentcaller": "0x7fff575658eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575659df", "parentcaller": "0x7fff575659a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5756513f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575625d3", "parentcaller": "0x7fff575633a5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564619", "parentcaller": "0x7fff575625f7", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000338" }, { "name": "SubKey", "value": "DefaultUserEnviroment" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\DefaultUserEnviroment" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57562608", "parentcaller": "0x7fff575633a5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564619", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "Environment" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575646ba", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000338" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "4" }, { "name": "MaxValueNameLength", "value": "8" }, { "name": "MaxValueLength", "value": "102" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "Path" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Microsoft\\WindowsApps;" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\Path" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "TEMP" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Temp" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\TEMP" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "TMP" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Temp" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\TMP" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "OneDrive" }, { "name": "Data", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\OneDrive" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "Path" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Microsoft\\WindowsApps;" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\Path" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "TEMP" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Temp" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\TEMP" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577cc0f2", "parentcaller": "0x7fff57564b8f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc100", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "TMP" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local\\Temp" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\TMP" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577cc0f2", "parentcaller": "0x7fff57564b8f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff577cc100", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "OneDrive" }, { "name": "Data", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment\\OneDrive" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564bb1", "parentcaller": "0x7fff575633bc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564619", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "Volatile Environment" }, { "name": "Handle", "value": "0x00000338" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575646ba", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000338" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "9" }, { "name": "MaxValueNameLength", "value": "25" }, { "name": "MaxValueLength", "value": "62" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "LOGONSERVER" }, { "name": "Data", "value": "\\\\DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\LOGONSERVER" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "USERDOMAIN" }, { "name": "Data", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERDOMAIN" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "USERNAME" }, { "name": "Data", "value": "admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERNAME" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "USERPROFILE" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERPROFILE" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "4" }, { "name": "ValueName", "value": "HOMEPATH" }, { "name": "Data", "value": "\\Users\\admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\HOMEPATH" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "HOMEDRIVE" }, { "name": "Data", "value": "C:" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\HOMEDRIVE" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "APPDATA" }, { "name": "Data", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\APPDATA" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "LOCALAPPDATA" }, { "name": "Data", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\LOCALAPPDATA" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "USERDOMAIN_ROAMINGPROFILE" }, { "name": "Data", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERDOMAIN_ROAMINGPROFILE" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "LOGONSERVER" }, { "name": "Data", "value": "\\\\DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\LOGONSERVER" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "USERDOMAIN" }, { "name": "Data", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERDOMAIN" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "2" }, { "name": "ValueName", "value": "USERNAME" }, { "name": "Data", "value": "admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERNAME" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "3" }, { "name": "ValueName", "value": "USERPROFILE" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERPROFILE" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "4" }, { "name": "ValueName", "value": "HOMEPATH" }, { "name": "Data", "value": "\\Users\\admin" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\HOMEPATH" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "5" }, { "name": "ValueName", "value": "HOMEDRIVE" }, { "name": "Data", "value": "C:" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\HOMEDRIVE" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "6" }, { "name": "ValueName", "value": "APPDATA" }, { "name": "Data", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\APPDATA" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "7" }, { "name": "ValueName", "value": "LOCALAPPDATA" }, { "name": "Data", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\LOCALAPPDATA" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575647e4", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" }, { "name": "Index", "value": "8" }, { "name": "ValueName", "value": "USERDOMAIN_ROAMINGPROFILE" }, { "name": "Data", "value": "DESKTOP-74SUV8W" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\USERDOMAIN_ROAMINGPROFILE" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564bb1", "parentcaller": "0x7fff575633d3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57564619", "parentcaller": "0x7fff5756341e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "Volatile Environment\\0" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\0" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5780f725", "parentcaller": "0x7fff57563562", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5780f80a", "parentcaller": "0x7fff57563562", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57582000" }, { "name": "ModuleName", "value": "profapi.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff574e7685", "parentcaller": "0x7fff574e751b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x17[\\xea\\x00\\x00\\x00\\xac$\\x00\\x00\\x00\\x00\\x00\\x00\\xd0-\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "11728" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff575662d2", "parentcaller": "0x7fff57563814", "category": "misc", "api": "GetComputerNameExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-74SUV8W" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57563a9e", "parentcaller": "0x7fff57562695", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5780f725", "parentcaller": "0x7fff4635c874", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5780f80a", "parentcaller": "0x7fff4635c874", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577f4448", "parentcaller": "0x7fff4638f089", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea110000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff4638f12e", "parentcaller": "0x7fff4635c9ff", "category": "process", "api": "UpdateProcThreadAttribute", "status": false, "return": "0x00000001", "arguments": [ { "name": "Attribute", "value": "131072" }, { "name": "Value", "value": "728" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff4638f183", "parentcaller": "0x7fff4635c9ff", "category": "process", "api": "UpdateProcThreadAttribute", "status": false, "return": "0x00000001", "arguments": [ { "name": "Attribute", "value": "393217" }, { "name": "Value", "value": "1005022347268" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff4638f1e3", "parentcaller": "0x7fff4635c9ff", "category": "process", "api": "UpdateProcThreadAttribute", "status": false, "return": "0x00000001", "arguments": [ { "name": "Attribute", "value": "131074" }, { "name": "Value", "value": "276" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff4638f237", "parentcaller": "0x7fff4635c9ff", "category": "process", "api": "UpdateProcThreadAttribute", "status": false, "return": "0x00000001", "arguments": [ { "name": "Attribute", "value": "131086" }, { "name": "Value", "value": "2" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff5781026b", "parentcaller": "0x7fff46385aca", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00000002" }, { "name": "TokenHandle", "value": "0x00000334" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff46385c31", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff46385c46", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000334" }, { "name": "ThreadHandle", "value": "0x00000340" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\WerFault.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\WerFault.exe -u -p 8756 -s 284" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "7024" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff4635ccfb", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\WerFault.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\WerFault.exe -u -p 8756 -s 284" }, { "name": "CreationFlags", "value": "0x00080400", "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7024" }, { "name": "ThreadId", "value": "11172" }, { "name": "ParentHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0x00000334" }, { "name": "ThreadHandle", "value": "0x00000340" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff4635ce00", "parentcaller": "0x7fff4635d333", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57801762", "parentcaller": "0x7fff4635ce68", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea110000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4635d390", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4635d106", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff171ebe94", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000334" }, { "name": "TargetProcessHandle", "value": "0x000002d8" }, { "name": "TargetHandle", "value": "0x00000150" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171ebce9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171ebcfd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 10:45:22,681", "thread_id": "4832", "caller": "0x7fff171e42ac", "parentcaller": "0x7fff171e4934", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff171e4d05", "parentcaller": "0x7fff171e4c19", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xce\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x18\\xcf\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002b0" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002b0" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002b0" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002b0" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002a4" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x000002b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002a4" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b0" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2146 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2150 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000032c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2185 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2188 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-29 10:45:22,869", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2206 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000033c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2277 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000348" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000348" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000033c" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000033c" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000033c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5536bb33", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 1, "id": 2347 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5781f70b", "parentcaller": "0x7fff171de87d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00110080", "pretty_value": "FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "f\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x003\\x00D\\x00E\\x00.\\x00t\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000033c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "f\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x003\\x00D\\x00E\\x00.\\x00t\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237980", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237130", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82373d0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "FirstCreateTimeLow", "value": "0x40474e76" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcef58" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff5781c0e0", "parentcaller": "0x7fff171dfe0d", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp" }, { "name": "FileInformationClass", "value": "13", "pretty_value": "FileDispositionInformation" }, { "name": "FileInformation", "value": "\\x01" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171dfe79", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0xea5bbfe658" }, { "name": "DesiredAccess", "value": "0x00110080", "pretty_value": "FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "n\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x003\\x00D\\x00E\\x00.\\x00t\\x00m\\x00p\\x00.\\x00c\\x00s\\x00v\\x00" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x0000032c" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-29 10:45:22,885", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "n\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x003\\x00D\\x00E\\x00.\\x00t\\x00m\\x00p\\x00.\\x00c\\x00s\\x00v\\x00" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82373d0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237600", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237de0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237600", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237440", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff171dc63a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff171dc63a", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\ntdll.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff171dd32c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "ZwQuerySystemInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed690" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff171dd3bf", "parentcaller": "0x7fff171e66d4", "category": "misc", "api": "NtQuerySystemInformation", "status": false, "return": "0xffffffffc0000004", "pretty_return": "INFO_LENGTH_MISMATCH", "arguments": [ { "name": "SystemInformationClass", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8266000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff171dd3bf", "parentcaller": "0x7fff171e66d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff171dcd03", "parentcaller": "0x7fff171dd41b", "category": "services", "api": "OpenSCManagerW", "status": true, "return": "0x2c0e8264110", "arguments": [ { "name": "MachineName", "value": "" }, { "name": "DatabaseName", "value": "" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SC_MANAGER_ENUMERATE_SERVICE" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8251000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8252000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "I\\x00m\\x00a\\x00g\\x00e\\x00N\\x00a\\x00m\\x00e\\x00" }, { "name": "Length", "value": "18" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00I\\x00d\\x00" }, { "name": "Length", "value": "32" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00N\\x00u\\x00m\\x00b\\x00e\\x00r\\x00O\\x00f\\x00T\\x00h\\x00r\\x00e\\x00a\\x00d\\x00s\\x00" }, { "name": "Length", "value": "32" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00S\\x00e\\x00t\\x00P\\x00r\\x00i\\x00v\\x00a\\x00t\\x00e\\x00S\\x00i\\x00z\\x00e\\x00" }, { "name": "Length", "value": "44" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00H\\x00a\\x00r\\x00d\\x00F\\x00a\\x00u\\x00l\\x00t\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "30" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00N\\x00u\\x00m\\x00b\\x00e\\x00r\\x00O\\x00f\\x00T\\x00h\\x00r\\x00e\\x00a\\x00d\\x00s\\x00H\\x00i\\x00g\\x00h\\x00W\\x00a\\x00t\\x00e\\x00r\\x00m\\x00a\\x00r\\x00k\\x00" }, { "name": "Length", "value": "58" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00C\\x00y\\x00c\\x00l\\x00e\\x00T\\x00i\\x00m\\x00e\\x00" }, { "name": "Length", "value": "20" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00C\\x00r\\x00e\\x00a\\x00t\\x00e\\x00T\\x00i\\x00m\\x00e\\x00" }, { "name": "Length", "value": "22" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00U\\x00s\\x00e\\x00r\\x00T\\x00i\\x00m\\x00e\\x00" }, { "name": "Length", "value": "18" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00K\\x00e\\x00r\\x00n\\x00e\\x00l\\x00T\\x00i\\x00m\\x00e\\x00" }, { "name": "Length", "value": "22" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00B\\x00a\\x00s\\x00e\\x00P\\x00r\\x00i\\x00o\\x00r\\x00i\\x00t\\x00y\\x00" }, { "name": "Length", "value": "26" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00e\\x00a\\x00k\\x00V\\x00i\\x00r\\x00t\\x00u\\x00a\\x00l\\x00S\\x00i\\x00z\\x00e\\x00" }, { "name": "Length", "value": "32" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00V\\x00i\\x00r\\x00t\\x00u\\x00a\\x00l\\x00S\\x00i\\x00z\\x00e\\x00" }, { "name": "Length", "value": "24" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00a\\x00g\\x00e\\x00F\\x00a\\x00u\\x00l\\x00t\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "30" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00S\\x00e\\x00t\\x00S\\x00i\\x00z\\x00e\\x00" }, { "name": "Length", "value": "30" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00e\\x00a\\x00k\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00S\\x00e\\x00t\\x00S\\x00i\\x00z\\x00e\\x00" }, { "name": "Length", "value": "38" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00Q\\x00u\\x00o\\x00t\\x00a\\x00P\\x00e\\x00a\\x00k\\x00P\\x00a\\x00g\\x00e\\x00d\\x00P\\x00o\\x00o\\x00l\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "48" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00Q\\x00u\\x00o\\x00t\\x00a\\x00P\\x00a\\x00g\\x00e\\x00d\\x00P\\x00o\\x00o\\x00l\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "40" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00Q\\x00u\\x00o\\x00t\\x00a\\x00P\\x00e\\x00a\\x00k\\x00N\\x00o\\x00n\\x00P\\x00a\\x00g\\x00e\\x00d\\x00P\\x00o\\x00o\\x00l\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "54" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00Q\\x00u\\x00o\\x00t\\x00a\\x00N\\x00o\\x00n\\x00P\\x00a\\x00g\\x00e\\x00d\\x00P\\x00o\\x00o\\x00l\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "46" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00a\\x00g\\x00e\\x00f\\x00i\\x00l\\x00e\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "28" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00e\\x00a\\x00k\\x00P\\x00a\\x00g\\x00e\\x00f\\x00i\\x00l\\x00e\\x00U\\x00s\\x00a\\x00g\\x00e\\x00" }, { "name": "Length", "value": "36" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00P\\x00r\\x00i\\x00v\\x00a\\x00t\\x00e\\x00P\\x00a\\x00g\\x00e\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "34" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00R\\x00e\\x00a\\x00d\\x00O\\x00p\\x00e\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "38" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00W\\x00r\\x00i\\x00t\\x00e\\x00O\\x00p\\x00e\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "40" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00O\\x00t\\x00h\\x00e\\x00r\\x00O\\x00p\\x00e\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "40" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00R\\x00e\\x00a\\x00d\\x00T\\x00r\\x00a\\x00n\\x00s\\x00f\\x00e\\x00r\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "36" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00W\\x00r\\x00i\\x00t\\x00e\\x00T\\x00r\\x00a\\x00n\\x00s\\x00f\\x00e\\x00r\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "38" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00O\\x00t\\x00h\\x00e\\x00r\\x00T\\x00r\\x00a\\x00n\\x00s\\x00f\\x00e\\x00r\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "38" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00H\\x00a\\x00n\\x00d\\x00l\\x00e\\x00C\\x00o\\x00u\\x00n\\x00t\\x00" }, { "name": "Length", "value": "24" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00I\\x00n\\x00h\\x00e\\x00r\\x00i\\x00t\\x00e\\x00d\\x00F\\x00r\\x00o\\x00m\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00I\\x00d\\x00" }, { "name": "Length", "value": "58" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00S\\x00e\\x00s\\x00s\\x00i\\x00o\\x00n\\x00I\\x00d\\x00" }, { "name": "Length", "value": "20" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": ",\\x00S\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\r\\x00\n\\x00" }, { "name": "Length", "value": "22" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "\"\\x00[\\x00I\\x00d\\x00l\\x00e\\x00]\\x00\"\\x00,\\x00" }, { "name": "Length", "value": "18" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "0\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "6\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "8\\x001\\x009\\x002\\x00,\\x00" }, { "name": "Length", "value": "10" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "0\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 1, "id": 2436 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "3\\x009\\x007\\x005\\x002\\x001\\x009\\x001\\x004\\x002\\x007\\x004\\x003\\x00,\\x00" }, { "name": "Length", "value": "28" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "1\\x003\\x004\\x002\\x004\\x004\\x008\\x009\\x005\\x005\\x006\\x008\\x008\\x004\\x003\\x002\\x008\\x007\\x00,\\x00" }, { "name": "Length", "value": "38" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "0\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "1\\x001\\x005\\x005\\x004\\x008\\x004\\x003\\x007\\x005\\x000\\x00,\\x00" }, { "name": "Length", "value": "24" } ], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "0\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "8\\x001\\x009\\x002\\x00,\\x00" }, { "name": "Length", "value": "10" } ], "repeated": 1, "id": 2442 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "9\\x00,\\x00" }, { "name": "Length", "value": "4" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "8\\x001\\x009\\x002\\x00,\\x00" }, { "name": "Length", "value": "10" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "1\\x002\\x002\\x008\\x008\\x00,\\x00" }, { "name": "Length", "value": "12" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-29 10:45:22,900", "thread_id": "11728", "caller": "0x7fff577d5326", "parentcaller": "0x7fff171e0875", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" }, { "name": "Buffer", "value": "0\\x00,\\x00" }, { "name": "Length", "value": "4" }, { "name": "Status", "value": "Maximum logged writes reached for this file" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0e8266000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e061a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "4832", "caller": "0x7fff171e42ac", "parentcaller": "0x7fff171e4934", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff171e4d05", "parentcaller": "0x7fff171e4c19", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xce\\xbf[\\xea\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00m\\x1a\\xff\\x7f\\x00\\x00\\x18\\xcf\\xbf[\\xea\\x00\\x00\\x00`\\x110\\x18\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xccV\\x18\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff5785463c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-18" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "NewUserDefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5533fd54", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f62b", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f69e", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000344" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340413", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DefaultConsent" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000344" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000344" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f6c0", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f744", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f79f", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f8aa", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f8f4", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DontSendAdditionalData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Disabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000340" }, { "name": "SubKey", "value": "Consent" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "DefaultOverrideBehavior" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534030a", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "LoggingDisabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DontShowUI" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" } ], "repeated": 0, "id": 2499 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "QueuePesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ForceQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "MaxQueueCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "MaxArchiveCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ConfigureArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DisableArchive" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff55340332", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000340" }, { "name": "SubKey", "value": "DebugApplications" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CorporateWerServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CorporateWerUseSSL" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CorporateWerPortNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CorporateWerUseAuthentication" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "BypassDataThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ForceUserModeCabCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "BypassPowerThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "BypassNetworkCostThrottling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "QueueNoPesterInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "AutoApproveOSDumps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "MinFreeDiskSpace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "LiveReportFlushInterval" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CabArchiveFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ForceHeapDump" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ForceMetadata" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "Source" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "User" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "StorePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ForceEtw" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CorporateWerUploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "UploadOnFreeNetworksOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CabArchiveSeparate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "CabArchiveCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "LocalCompression" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DisableWerUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DisableEnterpriseAuthProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "ArchiveFolderCountLimit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "QueueSizeMaxPercentFreeDisk" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "MinQueueSize" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "MaxRetriesForSasRenewal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "NoHeapDumpOnQueue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff553402d9", "parentcaller": "0x7fff5534022d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "DeferCabUpload" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5533f916", "parentcaller": "0x7fff5538c6a2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000340" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x000002d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000328" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x000002d8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000344" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000340" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000344" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 10:45:22,931", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x0000033c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000033c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d486", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d4a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySecurityPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefb60" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x00000340" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534d6ed", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d730", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534d7bd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff522d0000", "arguments": [ { "name": "lpLibFileName", "value": "policymanager.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_GetPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d6110" } ], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534d7f4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "ModuleHandle", "value": "0x7fff522d0000" }, { "name": "FunctionName", "value": "PolicyManager_FreeGetPolicyData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff522d90c0" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" }, { "name": "Handle", "value": "0x0000021c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "73777" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5236e000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7489", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8b24", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8b91", "parentcaller": "0x7fff522d750a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "RegValueNameRedirect" }, { "name": "Data", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d7b73", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d623c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x00000214" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d8c22", "parentcaller": "0x7fff522d702e", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d703c", "parentcaller": "0x7fff522d6316", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d63f2", "parentcaller": "0x7fff5534d839", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d5927", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection" }, { "name": "Handle", "value": "0x0000021c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d595e", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "ValueName", "value": "AllowTelemetry_PolicyManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff522d599b", "parentcaller": "0x7fff522d6999", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522daf75", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff522d9933", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff522d9792", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff522d974a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fbaaab", "parentcaller": "0x7fff59fba507", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dbb1", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" }, { "name": "Handle", "value": "0x000002ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dc1b", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5534dcc0", "parentcaller": "0x7fff5534d5fa", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff5534de5e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5534de79", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000002ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3659", "parentcaller": "0x7fff577d2f2c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "AllowTelemetry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5534e280", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f94f", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x000002ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ac" }, { "name": "ValueName", "value": "MSFTInternal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f977", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f99b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Policies\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533fe49", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\SQMClient" }, { "name": "Handle", "value": "0x00000340" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff5533fe8a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000340" }, { "name": "ValueName", "value": "IsTest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5533feb6", "parentcaller": "0x7fff5533f9c3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002ac" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00F\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "D\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5536b696", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff5536bb33", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" } ], "repeated": 1, "id": 2780 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff5781f70b", "parentcaller": "0x7fff171de87d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "DesiredAccess", "value": "0x00110080", "pretty_value": "FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "f\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x004\\x001\\x00D\\x00.\\x00t\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002ac" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00e\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "f\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x004\\x001\\x00D\\x00.\\x00t\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237440", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237ad0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e82373d0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237ad0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "FirstCreateTimeLow", "value": "0x4050db37" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcef58" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 10:45:22,947", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000000c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff5781c0e0", "parentcaller": "0x7fff171dfe0d", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000340" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" }, { "name": "FileInformationClass", "value": "13", "pretty_value": "FileDispositionInformation" }, { "name": "FileInformation", "value": "\\x01" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171dfe79", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0xea5bbfe658" }, { "name": "DesiredAccess", "value": "0x00110080", "pretty_value": "FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee4d8", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "n\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x004\\x001\\x00D\\x00.\\x00t\\x00m\\x00p\\x00.\\x00t\\x00x\\x00t\\x00" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577ef235", "parentcaller": "0x7fff577ee55a", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002a4" }, { "name": "IoControlCode", "value": "0x006d0030", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH" }, { "name": "InBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef2b7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577ee77b", "parentcaller": "0x7fff577ee587", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" }, { "name": "FileInformationClass", "value": "48", "pretty_value": "FileNetworkPhysicalNameInformation" }, { "name": "FileInformation", "value": "n\\x00\\x00\\x00\\\\x00P\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00W\\x00E\\x00R\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00\\\\x00W\\x00E\\x00R\\x00C\\x004\\x001\\x00D\\x00.\\x00t\\x00m\\x00p\\x00.\\x00t\\x00x\\x00t\\x00" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237910", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237050", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171dfb43", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237de0", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d07f5", "parentcaller": "0x7fff57815826", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237830", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237d70", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff57815984", "parentcaller": "0x7fff171deab1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x2c0e8237830", "arguments": [ { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xc867053b" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577cbe1d", "parentcaller": "0x7fff5781599a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff171dcfb8", "parentcaller": "0x7fff171e67d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff171dcfde", "parentcaller": "0x7fff171e67d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "2", "pretty_value": "FILE_CREATE" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff171dd004", "parentcaller": "0x7fff171e67d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "81" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff171dd02a", "parentcaller": "0x7fff171e67d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "119" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff171dd050", "parentcaller": "0x7fff171e67d4", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "120" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "11728", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171e061a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 10:45:22,963", "thread_id": "4832", "caller": "0x7fff171e42ac", "parentcaller": "0x7fff171e4934", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 10:45:23,885", "thread_id": "3700", "caller": "0x7fff577d6785", "parentcaller": "0x7fff171f75f2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 10:45:52,447", "thread_id": "11728", "caller": "0x7fff59767042", "parentcaller": "0x7fff59766fa4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 10:45:52,447", "thread_id": "13828", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 10:45:52,447", "thread_id": "13828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x2c0e8202340" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9392", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9392" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9392", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9376", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9376" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9376", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9332", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9332" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 10:46:22,353", "thread_id": "9332", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff59fa3748", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "4832", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000032c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000033c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "4832", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4832" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "4832", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "4832", "caller": "0x7fff577d6785", "parentcaller": "0x7fff597be4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "4832", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "3700", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3700" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "3700", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\Windows Error Reporting\\TermReason" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x0000027c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\TermReason" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "8" }, { "name": "MaxSubKeyLength", "value": "4" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "424" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "424" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "e\\x84\\\\xaf\\x05\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\CreationTime" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "5116" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "5116" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\xcb\\x18\\:X\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\CreationTime" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "7928" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "7928" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\x947Y\\x18X\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\CreationTime" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "8288" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "8288" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\xb9\\xc0v\\xaf\\x05\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\CreationTime" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "9116" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "9116" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000280" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x00000274" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "j\r\\x1a\\x9c\\x05\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\CreationTime" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "5" }, { "name": "Name", "value": "9148" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "9148" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\xb7Pp\\x1cX\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\CreationTime" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "6" }, { "name": "Name", "value": "9184" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "9184" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\xca\\xddD\\x16X\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\CreationTime" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Reason" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Terminator" }, { "name": "Data", "value": "HAM" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "Index", "value": "7" }, { "name": "Name", "value": "9204" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "9204" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x000f003f", "pretty_value": "KEY_ALL_ACCESS" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "CreationTime" }, { "name": "Data", "value": "\\x9f\\xca\\xf8\\xbf\\x05\\xef\\xdc\\x01" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\CreationTime" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17212000" }, { "name": "ModuleName", "value": "wersvc.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "SubKey", "value": "424" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "SubKey", "value": "8288" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "SubKey", "value": "9116" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegDeleteKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" }, { "name": "SubKey", "value": "9204" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22349d", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf223646", "parentcaller": "0x7ff7bf22351e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "System\\CurrentControlSet\\Services" }, { "name": "Handle", "value": "0x00000334" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf223673", "parentcaller": "0x7ff7bf22351e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000334" }, { "name": "SubKey", "value": "wersvc" }, { "name": "Handle", "value": "0x0000027c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\wersvc" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "9348", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000000c" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf22369f", "parentcaller": "0x7ff7bf22351e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027c" }, { "name": "SubKey", "value": "Parameters" }, { "name": "Handle", "value": "0x0000032c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf2236c5", "parentcaller": "0x7ff7bf22351e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf2236de", "parentcaller": "0x7ff7bf22351e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 10:47:22,978", "thread_id": "13828", "caller": "0x7ff7bf223555", "parentcaller": "0x7ff7bf2234a6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" }, { "name": "ValueName", "value": "ServiceDllUnloadOnStop" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDllUnloadOnStop" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea200000" }, { "name": "RegionSize", "value": "0x00200000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000270" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "r\\xa2F#\\xf2e/\\x1b\\xd5y\\xae\\xf0\\xc7\\xbay+\\x0e5'\\xf0\\xdc{\\x88\\xc3)\\xd5\\xdb\\xf6v\\xf4\\xd9\\xbb" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2c0ea100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d4" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d4" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b0" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ac" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000009c" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000098" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000008c" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000006c" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000004c" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000064" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000068" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 10:47:22,994", "thread_id": "9348", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 3114 } ], "threads": [ "9348", "11644", "11664", "11660", "2280", "11720", "3700", "4832", "11728", "13828", "9392", "9376", "9332" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 12224, "process_name": "svchost.exe", "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-29 10:45:43,510", "calls": [ { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rpcss.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000000c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f0b0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00143000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f0b0000" }, { "name": "RegionSize", "value": "0x00143000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000228" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000224" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dcb", "parentcaller": "0x7ff7bf222613", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dff", "parentcaller": "0x7ff7bf222613", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf222dff", "parentcaller": "0x7ff7bf222613", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000264", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff5992dfb0" }, { "name": "Parameter", "value": "0x18f1ea1caa0" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "11388" }, { "name": "ProcessId", "value": "12224" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "12228", "caller": "0x7ff7bf2218fe", "parentcaller": "0x7ff7bf2215e9", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000264" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "11388" }, { "name": "ProcessId", "value": "12224" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\flightsettings" }, { "name": "DllBase", "value": "0x7fff40a10000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf223baa", "parentcaller": "0x7ff7bf224126", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\flightsettings.dll" }, { "name": "BaseAddress", "value": "0x7fff40a10000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224dba", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WLDP" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224dba", "parentcaller": "0x7ff7bf223c11", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "WLDP.DLL" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034E-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "000001DA-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rpcss.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f20900000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00143000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f20900000" }, { "name": "RegionSize", "value": "0x00143000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000294" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002b0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x18f1ea186b0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "5068" }, { "name": "ProcessId", "value": "12224" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "4168", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wtsapi32.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52b00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00014000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wtsapi32" }, { "name": "DllBase", "value": "0x7fff52b00000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\winsta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57360000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7fff57360000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff57366c01", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff50870000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:45:43,556", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "11388", "caller": "0x7ff7bf224340", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1FD1B5A7-5C96-4711-A7C3-FFF6D21F93D9" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "DF8E9480-CA73-448E-B8F0-DA000F581428" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff48780000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a1000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000308" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000030c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0008a000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "c:\\windows\\system32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wosc" }, { "name": "DllBase", "value": "0x7fff188a0000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wosc.dll" }, { "name": "BaseAddress", "value": "0x7fff188a0000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\FlightSettings.dll" }, { "name": "BaseAddress", "value": "0x7fff40a10000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity" }, { "name": "DllBase", "value": "0x7fff42490000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll" }, { "name": "BaseAddress", "value": "0x7fff42490000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x7fff4f560000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\npmproxy.dll" }, { "name": "BaseAddress", "value": "0x7fff4f560000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:45:43,572", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000298" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WinTypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000033c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\IPHLPAPI.DLL" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000340" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff569f0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0003b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7fff569f0000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000344" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b20000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00008000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7fff58b20000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Nsi" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000348" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dusmapi.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000034c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff40900000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00011000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dusmapi" }, { "name": "DllBase", "value": "0x7fff40900000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Cabinet" }, { "name": "DllBase", "value": "0x7fff4f590000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\UpdatePolicy" }, { "name": "DllBase", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UpdatePolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7fff47980000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Web.dll" }, { "name": "BaseAddress", "value": "0x7fff47980000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000368" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:45:43,588", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000368" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 91 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 93 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\Windows.Web.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f0f0000" }, { "name": "SectionOffset", "value": "0x81bdd7b850" }, { "name": "ViewSize", "value": "0x0002a000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002f0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000035c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f20c00000" }, { "name": "SectionOffset", "value": "0x81bdd7a900" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff57f82199", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:45:43,603", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 112 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 115 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7fff3e220000" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll" }, { "name": "BaseAddress", "value": "0x7fff3e220000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 119 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 121 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:45:43,619", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\fcon" }, { "name": "DllBase", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\rsaenh" }, { "name": "DllBase", "value": "0x7fff56630000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 150 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 152 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 156 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:45:43,635", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 158 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 166 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 168 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:45:43,650", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 184 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 197 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:45:43,666", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1743db4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 208 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff17420000" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 210 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:45:43,681", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17420000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000039c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 279 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:45:43,697", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 281 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 295 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:45:43,713", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 298 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 300 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 302 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000040c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 328 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 330 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000036c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 334 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 336 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:45:43,728", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 344 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 346 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:45:43,744", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 362 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 375 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:45:43,760", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1743db4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 386 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff17420000" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 388 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:45:43,775", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17420000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000414" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000414" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 457 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 459 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:45:43,791", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 473 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 476 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 478 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 480 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:45:43,806", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 506 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 508 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000418" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 512 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 514 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 522 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 524 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:45:43,822", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 540 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000444" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 553 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:45:43,838", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1743db4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 564 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff17420000" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 566 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17420000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:45:43,853", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 620 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 635 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 637 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:45:43,869", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 651 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 654 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 656 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 658 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:45:43,885", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 684 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 686 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000424" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000424" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 690 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 692 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000450" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 700 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 702 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:45:43,900", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000450" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 718 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:45:43,916", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 731 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1743db4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 742 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff17420000" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 744 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003f0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17420000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:45:43,931", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 798 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000370" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 813 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 815 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:45:43,947", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 829 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 832 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 834 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 836 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 862 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 864 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 10:45:43,963", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 868 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 870 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004b8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004b8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 878 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 880 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004b8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004b8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 10:45:43,978", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 896 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 909 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 10:45:43,994", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1743db4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 920 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff17420000" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 922 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000518" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000518" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000518" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000518" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1750a7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff17420000" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17420000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 10:45:44,010", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000043c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 992 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 10:45:44,056", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 994 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000448" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 10:45:44,072", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1008 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1011 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1013 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1015 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1041 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1043 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000468" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1047 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1049 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 10:45:44,088", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1057 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1059 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1075 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 10:45:44,103", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 1088 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff12fddb4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 1099 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1101 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 10:45:44,119", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1170 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1172 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 10:45:44,135", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004d8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1186 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1189 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1191 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1193 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 10:45:44,150", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1219 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1221 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ac" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ac" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1225 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1227 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000540" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000540" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1235 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1237 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000540" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000540" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-29 10:45:44,166", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1253 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000540" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 1266 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-29 10:45:44,181", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff12fddb4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 1277 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1279 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000059c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000059c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000059c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000059c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-29 10:45:44,197", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000484" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1348 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1350 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000484" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-29 10:45:44,213", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1364 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1367 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1369 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1371 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004cc" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1397 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-29 10:45:44,228", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1399 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000054c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000054c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1403 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1405 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1413 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1415 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000374" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-29 10:45:44,244", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1431 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 1444 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-29 10:45:44,260", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff12fddb4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 1455 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1457 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000520" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000520" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000520" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000520" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1511 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-29 10:45:44,275", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000041c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1526 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1528 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003d0" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-29 10:45:44,291", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1542 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1545 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1547 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1549 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000037c" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1575 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1577 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1581 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-29 10:45:44,306", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1583 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1591 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1593 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-29 10:45:44,322", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1609 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 1622 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff12fddb4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 1633 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1635 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 10:45:44,338", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 1, "id": 1689 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000440" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000430" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1704 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 10:45:44,353", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1706 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 10:45:44,369", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1720 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff4563439a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1723 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35e5d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "AEPIC.dll" }, { "name": "BaseAddress", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229bbc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1725 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e22958d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "policymanager.dll" }, { "name": "BaseAddress", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff3e229506", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1727 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35ec4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\AEPIC" }, { "name": "DllBase", "value": "0x7fff45630000" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff45630000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "fcon.dll" }, { "name": "BaseAddress", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000544" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000544" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000544" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000544" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1753 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1755 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003a4" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1759 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1761 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 10:45:44,385", "thread_id": "6068", "caller": "0x7fff4249aaab", "parentcaller": "0x7fff42493f31", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A47979D2-C419-11D9-A5B4-001185AD2B89" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff188bd3db", "parentcaller": "0x7fff188bd0dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "07369A67-07A6-4608-ABEA-379491CB7C46" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "152807BD-4D18-46C5-AE31-DD8D597D0559" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 5, "id": 1769 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Models" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7fff47984b50" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 1771 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d9dd2", "parentcaller": "0x7fff188c60b0", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x80000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff5780befb", "parentcaller": "0x7fff188a8442", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a8" }, { "name": "HandleName", "value": "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff40a403f2", "parentcaller": "0x7fff40a40347", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a40d0f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "updatepolicy.dll" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff3ee5b949", "parentcaller": "0x7fff3ee56260", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "3185A766-B338-11E4-A71E-12E3F512A338" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "utcutil.dll" }, { "name": "BaseAddress", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b6b762", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1787 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a401b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "dcntel.dll" }, { "name": "BaseAddress", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 10:45:44,400", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b35130", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Tbs.dll" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff4fa12d13", "parentcaller": "0x7fff19b35179", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0xc0000000", "pretty_value": "GENERIC_READ|GENERIC_WRITE" }, { "name": "FileName", "value": "\\??\\TPM" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff19b35197", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59ef0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4fa10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff1c386525", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "wldp.dll" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004c0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b7ccae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 1, "id": 1800 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff12fddb4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 2, "id": 1811 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff40a3ff29", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "appraiser.dll" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 1, "id": 1813 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000548" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000548" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000548" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000548" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff130aa7bb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff19b71416", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\utcutil" }, { "name": "DllBase", "value": "0x7fff1c380000" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c380000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcntel" }, { "name": "DllBase", "value": "0x7fff19b10000" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a40069", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\logoncli" }, { "name": "DllBase", "value": "0x7fff56b10000" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 10:45:44,416", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff19b10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\appraiser" }, { "name": "DllBase", "value": "0x7fff12fc0000" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff577cacfe", "parentcaller": "0x7fff40a3fdd4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\WDSCORE" }, { "name": "DllBase", "value": "0x18f1f120000" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f120000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\MSI" }, { "name": "DllBase", "value": "0x7fff1c620000" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff1c620000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f170000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fd290d", "parentcaller": "0x7fff59f635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43550000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\VERSION" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43500000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\tdh" }, { "name": "DllBase", "value": "0x7fff55ff0000" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55ff0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\setupapi" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\cfgmgr32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59a80000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SAMCLI" }, { "name": "DllBase", "value": "0x7fff4d3b0000" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d3b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56a30000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff12fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 10:45:44,431", "thread_id": "6068", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7fff56630000" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wosc" }, { "name": "DllBase", "value": "0x7fff188a0000" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff188a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity" }, { "name": "DllBase", "value": "0x7fff42490000" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7fff569f0000" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7fff58b20000" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff569f0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dusmapi" }, { "name": "DllBase", "value": "0x7fff40900000" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff40900000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff42490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff48780000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\UpdatePolicy" }, { "name": "DllBase", "value": "0x7fff3ee40000" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Cabinet" }, { "name": "DllBase", "value": "0x7fff4f590000" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4f590000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57520000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57130000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aa0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3ee40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\fcon" }, { "name": "DllBase", "value": "0x7fff42c10000" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff42c10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7fff3e220000" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3e220000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x7fff4f560000" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4f560000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "c:\\windows\\system32\\flightsettings" }, { "name": "DllBase", "value": "0x7fff40a10000" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wtsapi32" }, { "name": "DllBase", "value": "0x7fff52b00000" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7fff57360000" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57360000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52b00000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "c:\\windows\\system32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff566c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff522d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff40a10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff50870000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7fff47980000" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x18f1f0f0000" }, { "name": "RegionSize", "value": "0x0002a000" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4d6a0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff47980000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WinTypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf221918", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 10:46:44,431", "thread_id": "12228", "caller": "0x7ff7bf22196c", "parentcaller": "0x7ff7bf2215e9", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1920 } ], "threads": [ "12228", "11388", "4168", "6068" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 13492, "process_name": "dllhost.exe", "parent_id": 832, "module_path": "C:\\Windows\\System32\\dllhost.exe", "first_seen": "2026-05-29 10:45:48,869", "calls": [ { "timestamp": "2026-05-29 10:45:48,931", "thread_id": "13656", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 0 }, { "timestamp": "2026-05-29 10:45:48,931", "thread_id": "13496", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff6706b14e0" }, { "name": "Parameter", "value": "0x99ff327000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b12f2", "parentcaller": "0x7ff6706b13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f268000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b12f2", "parentcaller": "0x7ff6706b13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f269000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1349", "parentcaller": "0x7ff6706b13dc", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff6706b1b60" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13660", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13660", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13648", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000206" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13656", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13656", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18342030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13652", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f26b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13652", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13652", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff18341e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "13496" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000020c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001f8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001f8" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001f8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000001f8" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xc9\\xe3\\x1a\\x97\\xc5c-\\x9f\\x15P\\xc9Flb\\xadT\\xf1\\x1e\\x16\\xe9\\xb8\\x06\\x90#,8\\xb1\\x13\\x02\\xf2k\\xae\\xe1\t\\xddr\\x7f\\xc9\\x82\\xc2F\\xdbo/)m_v" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b1153", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f26c000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5854f760" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000022c" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xf4\\x12\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0R\\x18\\xff\\x7f\\x00\\x00\\xa0\\xbdR\\x18\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xb0\\xf4\\x12\\xff\\x99\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0R\\x18" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "MutexName", "value": "Local\\SM0:13492:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f230000" }, { "name": "SectionOffset", "value": "0x99ff12f4d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58bd4000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58ba8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7fff58b30000" }, { "name": "InitRoutine", "value": "0x7fff58b4d990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x29420b60000" }, { "name": "SectionOffset", "value": "0x99ff12f220" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000246" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000246" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x0000024a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024a" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000248" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xed\\x12\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00F\\x02\\x00\\x00\\x00\\x00\\x00\\x00PQzX\\xff\\x7f\\x00\\x00" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000248" }, { "name": "SubKey", "value": "Software\\Classes" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f273000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f275000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000250" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000250" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000250" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xec\\x12\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0R\\x18\\xff\\x7f\\x00\\x00\\xa0\\xbdR\\x18\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xc0\\xec\\x12\\xff\\x99\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0R\\x18" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000252" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000252" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000258" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000258" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000252" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000252" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000250" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000250" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000258" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\x1e'\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00002100" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xf1\\x12\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C}W\\xff\\x7f\\x00\\x00 _\\x81@[\\xbb\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f277000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x000034b4" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.13492" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f279000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000266" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000266" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000026a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026a" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000266" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f27b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "ValueName", "value": "NdrOleExtDLL" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "NdrOleInitializeExtension" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58574240" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000264" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "('&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00e\\x00" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf0'&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8\\x1e'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8 &\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00Pl\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x80\\xe7\\x12\\xff\\x99\\x00\\x00\\x00x\\xe7\\x12\\xff\\x99\\x00\\x00\\x00H\\xe7\\x12\\xff\\x99\\x00\\x00\\x00h\\xe7\\x12\\xff" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xe5\\x12\\xff\\x99\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H(&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0!&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00N_RO\\x00 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\x19'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x88!&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x000h\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xe0\\xe3\\x12\\xff\\x99\\x00\\x00\\x00\\xd8\\xe3\\x12\\xff\\x99\\x00\\x00\\x00\\xa8\\xe3\\x12\\xff\\x99\\x00\\x00\\x00\\xc8\\xe3\\x12\\xff" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80!&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xe1\\x12\\xff\\x99\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 10:45:48,947", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000268" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2941f264c20" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "13736" }, { "name": "ProcessId", "value": "13492" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000268", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2941f264c20" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "13736" }, { "name": "ProcessId", "value": "13492" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000270" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(!&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00N_RO\\x00 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0'&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x88!&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x80Q\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xeb\\x12\\xff\\x99\\x00\\x00\\x00H\\xeb\\x12\\xff\\x99\\x00\\x00\\x00\\x18\\xeb\\x12\\xff\\x99\\x00\\x00\\x008\\xeb\\x12\\xff" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80!&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe9\\x12\\xff\\x99\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8'&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P(&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\x19'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8#&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00`l\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\xa8\\xe7\\x12\\xff\\x99\\x00\\x00\\x00x\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\x98\\xe7\\x12\\xff" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0#&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe5\\x12\\xff\\x99\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(!&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00N_RO\\x00 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90!&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8#&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x80Q\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xeb\\x12\\xff\\x99\\x00\\x00\\x00H\\xeb\\x12\\xff\\x99\\x00\\x00\\x00\\x18\\xeb\\x12\\xff\\x99\\x00\\x00\\x008\\xeb\\x12\\xff" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0#&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe9\\x12\\xff\\x99\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "('&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00e\\x00" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf0'&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\x19'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "H(&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00`l\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\xa8\\xe7\\x12\\xff\\x99\\x00\\x00\\x00x\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\x98\\xe7\\x12\\xff" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe5\\x12\\xff\\x99\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000270" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "('&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00e\\x00" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0!&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00N_RO\\x00 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x18'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8'&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x80Q\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xeb\\x12\\xff\\x99\\x00\\x00\\x00H\\xeb\\x12\\xff\\x99\\x00\\x00\\x00\\x18\\xeb\\x12\\xff\\x99\\x00\\x00\\x008\\xeb\\x12\\xff" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0'&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe9\\x12\\xff\\x99\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H(&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90!&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8#&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00`l\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\xa8\\xe7\\x12\\xff\\x99\\x00\\x00\\x00x\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\x98\\xe7\\x12\\xff" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0#&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe5\\x12\\xff\\x99\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f27d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(!&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00N_RO\\x00 &\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x90!&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "('&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x80Q\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00P\\xeb\\x12\\xff\\x99\\x00\\x00\\x00H\\xeb\\x12\\xff\\x99\\x00\\x00\\x00\\x18\\xeb\\x12\\xff\\x99\\x00\\x00\\x008\\xeb\\x12\\xff" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 '&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe9\\x12\\xff\\x99\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8'&\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0#&\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x1b'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "H(&\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00`l\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\xa8\\xe7\\x12\\xff\\x99\\x00\\x00\\x00x\\xe7\\x12\\xff\\x99\\x00\\x00\\x00\\x98\\xe7\\x12\\xff" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(&\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe5\\x12\\xff\\x99\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f27e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13740", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x2941f240b50" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13740", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000284" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13740", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f280000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13740", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f281000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x2941f240b50" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2941f265460" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "13748" }, { "name": "ProcessId", "value": "13492" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000294", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2941f265460" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "13748" }, { "name": "ProcessId", "value": "13492" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x2941f265460" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff581d2b57", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff54fc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff581d2bbb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7fff54fc0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff54fccde0" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff54fcce20", "parentcaller": "0x7fff581d2d8c", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff59f667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xea\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f667ec", "parentcaller": "0x7fff577b5140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff54ffd921", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d3018", "parentcaller": "0x7fff54ffd921", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff54fcd96c", "parentcaller": "0x7fff54fcd1d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f286000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b8" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8Y(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10T(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x1b'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "HS(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xd0P|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xec\\xef\\xff\\x99\\x00\\x00\\x00\\xf8\\xeb\\xef\\xff\\x99\\x00\\x00\\x00\\xc8\\xeb\\xef\\xff\\x99\\x00\\x00\\x00\\xe8\\xeb\\xef\\xff" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@S(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe9\\xef\\xff\\x99\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "HM(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10Q(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x08Z(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xb0l|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00`\\xe8\\xef\\xff\\x99\\x00\\x00\\x00X\\xe8\\xef\\xff\\x99\\x00\\x00\\x00(\\xe8\\xef\\xff\\x99\\x00\\x00\\x00H\\xe8\\xef\\xff" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe6\\xef\\xff\\x99\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f287000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8O(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "pQ(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\x17'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "HP(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00pS\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xa0\\xe8\\x12\\xff\\x99\\x00\\x00\\x00\\x98\\xe8\\x12\\xff\\x99\\x00\\x00\\x00h\\xe8\\x12\\xff\\x99\\x00\\x00\\x00\\x88\\xe8\\x12\\xff" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@P(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe6\\x12\\xff\\x99\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8M(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x10W(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x18'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8X(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xd0o\\x81@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x00\\xe5\\x12\\xff\\x99\\x00\\x00\\x00\\xf8\\xe4\\x12\\xff\\x99\\x00\\x00\\x00\\xc8\\xe4\\x12\\xff\\x99\\x00\\x00\\x00\\xe8\\xe4\\x12\\xff" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0X(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe2\\x12\\xff\\x99\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x2941f271370" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "13756" }, { "name": "ProcessId", "value": "13492" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000294", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x2941f271370" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "13756" }, { "name": "ProcessId", "value": "13492" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "Milliseconds", "value": "20000" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f289000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58587db0" }, { "name": "Parameter", "value": "0x2941f271370" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58587dc9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58587dc9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" }, { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "13756" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13756", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f28a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f28c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xb5\\xaf\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x03\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5854d427", "parentcaller": "0x7fff584c3d82", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x2941f242268", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f28d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5857433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585743bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002ca" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xcb\\xdf\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x000\\xcc\\xdf\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ca" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002ca" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002ce" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ce" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ce" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ce" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ce" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ce" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc9\\xdf\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xc0\\xca\\xdf\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ca" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc9\\xdf\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xc0\\xca\\xdf\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002ca" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff585494b2", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff585494ea", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c8" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff58549503", "parentcaller": "0x7fff585354b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5854de68", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x000002c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5854dea4", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c8" }, { "name": "ValueName", "value": "GipActivityBypass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5854debd", "parentcaller": "0x7fff585071ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002d8" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8N(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0T(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\x1b'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8K(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00`}|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xb0\\xd6\\xef\\xff\\x99\\x00\\x00\\x00\\xa8\\xd6\\xef\\xff\\x99\\x00\\x00\\x00x\\xd6\\xef\\xff\\x99\\x00\\x00\\x00\\x98\\xd6\\xef\\xff" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0K(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xd4\\xef\\xff\\x99\\x00\\x00\\x00\\xd8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88U(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0O(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\x19'\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8W(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\xc0y|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\x10\\xd3\\xef\\xff\\x99\\x00\\x00\\x00\\x08\\xd3\\xef\\xff\\x99\\x00\\x00\\x00\\xd8\\xd2\\xef\\xff\\x99\\x00\\x00\\x00\\xf8\\xd2\\xef\\xff" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0W(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xd0\\xef\\xff\\x99\\x00\\x00\\x00\\xd8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5781c06d", "parentcaller": "0x7fff577cd794", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x29420b70000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577ced78", "parentcaller": "0x7fff578206f5", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577cdbb1", "parentcaller": "0x7fff577cd381", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 504 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff577cdda6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff5781c06d", "parentcaller": "0x7fff577cdcda", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x29420b80000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff577cdd0d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f290000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002d6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xcd\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xd6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00`\\xce\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xd6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xf0\\xcc\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xd6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xf0\\xcc\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002d6" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff58575483", "parentcaller": "0x7fff584f4bdc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584f4c07", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002de" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d9bff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d9d1a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584d9e39", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 10:45:48,963", "thread_id": "13748", "caller": "0x7fff584d9e8d", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d9ee0", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d9f30", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d9f84", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d9fa7", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff58569058", "parentcaller": "0x7fff584d9fcb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da010", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da052", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da0a5", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da0de", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da123", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da1c8", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da227", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da28a", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584da318", "parentcaller": "0x7fff584f4dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584f4e2a", "parentcaller": "0x7fff584da9ba", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5857450c", "parentcaller": "0x7fff584daa90", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff58574529", "parentcaller": "0x7fff584daa90", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577cddf0", "parentcaller": "0x7fff58574a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577cde10", "parentcaller": "0x7fff58574a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xd6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x000\\xcc\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d6" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002d6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002d6" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "BaseAddress", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff432b0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432ca900" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432dc5c0" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7fff432b0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff432cbe50" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43313000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff43313000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584e0e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5850c590" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbd\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x90\\xbe\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 621 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xbc\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00 \\xbd\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xbc\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00 \\xbd\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xba\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00P\\xbb\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 653 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb8\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xe0\\xb9\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb8\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\xe0\\xb9\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f6" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xb8\\xef\\xff\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcfR\\x18\\xff\\x7f\\x00\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2R\\x18\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x99\\x00\\x00\\x00 \\xb9\\xef\\xff\\x99\\x00\\x00\\x00" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002f6" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f6" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f6" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\propsys" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7fff52860000" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52860000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\propsys.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5286b810" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7fff52860000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52896430" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000304" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8N(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "pQ(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\x0e)\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8U(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x000p|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00\\xe0\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\xd8\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\xa8\\xcb\\xef\\xff\\x99\\x00\\x00\\x00\\xc8\\xcb\\xef\\xff" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0U(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xc9\\xef\\xff\\x99\\x00\\x00\\x00\\x04\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0\\x9c\\x1d\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xe8L(\\x1f\\x94\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "PS(\\x1f\\x94\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\x0e)\\x1f\\x94\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8W(\\x1f\\x94\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@V\\x18\\xff\\x7f\\x00\\x00\\xebP.\\x18\\xff\\x7f\\x00\\x00\\x90\\x0c|@[\\xbb\\x00\\x00(NR\\x18\\xff\\x7f\\x00\\x00@\\xc8\\xef\\xff\\x99\\x00\\x00\\x008\\xc8\\xef\\xff\\x99\\x00\\x00\\x00\\x08\\xc8\\xef\\xff\\x99\\x00\\x00\\x00(\\xc8\\xef\\xff" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0W(\\x1f\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8/\\x18\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xc6\\xef\\xff\\x99\\x00\\x00\\x00\\x04\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2R\\x18" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 10:45:48,978", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 10:45:48,994", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 10:45:49,010", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 10:45:49,025", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584fb0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff58522cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13748", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13748", "caller": "0x7fff432c5294", "parentcaller": "0x7fff58535144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13744", "caller": "0x7fff58520e98", "parentcaller": "0x7fff5859b785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00190024" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 10:45:49,041", "thread_id": "13496", "caller": "0x7ff6706b116a", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "13492" }, { "name": "ThreadId", "value": "13748" }, { "name": "Message", "value": "1033" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff432dc60f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff432c9248", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff432c774b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff432c774b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7fff432b0000" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59fa0444", "parentcaller": "0x7fff580a4def", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff5808c408", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5808c3cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5808c3cb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59fc0db0", "parentcaller": "0x7fff59f80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff432b0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff58542ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58544324", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff5781f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "13748" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13744", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f26c000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f278000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f298000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f292000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13744", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2941f230000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000232" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13748", "caller": "0x7fff581815b8", "parentcaller": "0x7fff59f69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1176", "parentcaller": "0x7ff6706b1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 10:45:54,041", "thread_id": "13496", "caller": "0x7ff6706b1193", "parentcaller": "0x7ff6706b1466", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 833 } ], "threads": [ "13656", "13496", "13660", "13648", "13652", "13740", "13744", "13748", "13756" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6706b0000", "MainExeSize": "0x00009000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "explorer.exe", "pid": 4484, "parent_id": 4364, "module_path": "C:\\Windows\\explorer.exe", "children": [ { "name": "msedge.exe", "pid": 4104, "parent_id": 4484, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "children": [ { "name": "identity_helper.exe", "pid": 9656, "parent_id": 4104, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "children": [], "threads": [ "9660", "9788", "9792", "9796", "9800", "9996", "10004", "10012", "10016", "10020", "10024", "10028", "10032", "10060", "10084", "10088", "10092", "10096", "9760", "3388", "9292" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6c7670000", "MainExeSize": "0x0028c000", "Bitness": "64-bit" } } ], "threads": [ "4828", "8792", "5984", "3368", "4336", "2864", "8940", "8912", "3372", "3256", "8576", "6740", "3744", "5828", "8764", "4964", "2912", "6796", "340", "3276", "1728", "9524", "3520", "8276", "3036" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7f5380000", "MainExeSize": "0x00505000", "Bitness": "64-bit" } } ], "threads": [ "6148", "4720", "4696", "2440", "5100", "4840", "5096", "5108", "5000", "6220", "7840", "6252", "4744", "5952", "6096", "4668", "4772", "5228", "4488", "4340", "4672", "4580", "4576", "4500", "4664", "3424", "5220", "4812", "4344", "4740", "4140", "4956", "6160", "11812", "5596", "12160", "12188", "9344" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\Explorer.EXE", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff79bc10000", "MainExeSize": "0x00546000", "Bitness": "64-bit" } }, { "name": "services.exe", "pid": 676, "parent_id": 556, "module_path": "C:\\Windows\\System32\\services.exe", "children": [ { "name": "svchost.exe", "pid": 832, "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [ { "name": "SecurityHealthHost.exe", "pid": 11836, "parent_id": 832, "module_path": "C:\\Windows\\System32\\SecurityHealthHost.exe", "children": [], "threads": [ "11840", "11960", "11956", "11968", "12044", "12048", "12052", "12140", "12144" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff652cf0000", "MainExeSize": "0x0001a000", "Bitness": "64-bit" } }, { "name": "dllhost.exe", "pid": 13492, "parent_id": 832, "module_path": "C:\\Windows\\System32\\dllhost.exe", "children": [], "threads": [ "13656", "13496", "13660", "13648", "13652", "13740", "13744", "13748", "13756" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6706b0000", "MainExeSize": "0x00009000", "Bitness": "64-bit" } } ], "threads": [ "1640", "1652", "464", "3476", "9132", "936", "9164", "928", "9136", "5988", "1064", "432", "780", "13556" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } }, { "name": "MicrosoftEdgeUpdate.exe", "pid": 5932, "parent_id": 676, "module_path": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "children": [ { "name": "MicrosoftEdgeUpdate.exe", "pid": 11132, "parent_id": 5932, "module_path": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "children": [], "threads": [ "11136", "11236", "11248", "11244", "11240", "8548", "11172", "6408", "7024", "11284", "11324" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00150000", "MainExeSize": "0x00035000", "Bitness": "32-bit" } } ], "threads": [ "9680", "2628", "8292", "3276", "9284", "5888", "10244", "10256", "10272", "10276", "10280", "10312", "10332", "10340", "10356", "10416", "10484" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00150000", "MainExeSize": "0x00035000", "Bitness": "32-bit" } }, { "name": "svchost.exe", "pid": 9388, "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [], "threads": [ "9348", "11644", "11664", "11660", "2280", "11720", "3700", "4832", "11728", "13828", "9392", "9376", "9332" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } }, { "name": "svchost.exe", "pid": 12224, "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [], "threads": [ "12228", "11388", "4168", "6068" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } } ], "threads": [ "3952", "4136", "9288", "4436", "504", "4984" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\services.exe", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7839a0000", "MainExeSize": "0x000b0000", "Bitness": "64-bit" } } ], "summary": { "files": [ "C:\\", "C:\\Users\\desktop.ini", "C:\\Users", "C:\\Users\\admin", "C:\\Users\\admin\\AppData", "C:\\Users\\admin\\AppData\\Roaming", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", "C:\\Users\\Public\\Desktop", "C:\\Users\\admin\\Desktop", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg", "C:\\Windows\\", "C:\\Windows\\System32\\", "\\Device\\Bam", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\PenWorkspace\\DiscoverCacheData.dat", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", "C:\\Windows\\apppatch\\sysmain.sdb", "C:\\Program Files (x86)\\Microsoft\\", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk", "C:\\Users\\admin\\AppData\\Local", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db", "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe", "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun", "C:\\Users\\admin\\Desktop\\desktop.ini", "C:\\Users\\Public\\desktop.ini", "C:\\Users\\Public", "C:\\Users\\Public\\Desktop\\desktop.ini", "C:\\Windows\\System32\\twinui.pcshell.dll", "C:\\Windows\\System32\\SecurityHealthSSO.dll", "\\??\\Volume{528C102F-0000-0000-0000-300300000000}", "\\Device\\HarddiskVolume2\\\\xe68\\x02", "\\??\\MountPointManager", "C:\\Windows\\System32\\services.exe", "C:\\Windows\\System32\\en-US\\services.exe.mui", "C:\\Windows\\explorer.exe", "C:\\Windows\\System32\\d3d10warp.dll", "C:\\Windows\\Fonts\\seguisb.ttf", "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources.pri", "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\pris\\", "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\", "C:\\Windows\\rescache\\_merged\\2716907977\\3245838983.pri", "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\pris\\resources.en-US.pri", "::\\", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer", "C:\\Windows\\System32\\imageres.dll", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", "C:\\Windows\\System32\\en-US\\imageres.dll.mui", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun", "C:\\Windows\\SystemResources\\imageres.dll.mun", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", "C:\\Program Files\\desktop.ini", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Discord Inc\\Discord.lnk", "C:\\program files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe", "C:\\Program Files", "C:\\Program Files\\WindowsApps", "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", "C:\\Users\\Public\\Desktop\\Google Chrome.lnk", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk", "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "C:\\Users\\Public\\Desktop\\", "C:\\Users\\Public\\", "C:\\Users\\admin\\AppData\\Local\\Discord\\app.ico", "C:\\Users\\", "C:\\Users\\Public\\Desktop\\Steam.lnk", "C:\\Users\\admin\\Desktop\\Discord.lnk", "C:\\Program Files (x86)\\Steam\\Steam.exe.Config", "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources", "C:\\Program Files\\WindowsApps\\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\\_resources\\", "C:\\Program Files\\WindowsApps\\", "C:\\Program Files\\", "C:", "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe", "C:\\Users\\admin\\AppData\\Local\\Discord\\Update.exe.Config", "C:\\program files (x86)\\Steam\\steam.exe", "C:\\program files (x86)\\SystemResources\\steam.exe.mun", "C:\\Users\\admin\\Desktop\\", "C:\\Users\\admin\\Desktop\\Gmail.url", "C:\\Users\\admin\\", "C:\\Users\\admin\\Desktop\\WhatsApp Web.url", "C:\\program files\\Google\\Chrome\\application\\chrome.exe", "C:\\program files\\Google\\Chrome\\SystemResources\\chrome.exe.mun", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", "C:\\Windows\\System32\\usp10.dll", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "\\??\\pipe\\crashpad_4104_VNIRRYNIERXILDVP", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak", "C:\\Windows\\System32\\policymanager.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll", "C:\\Windows\\System32\\msvcp110_win.dll", "C:\\Windows\\System32\\usermgrcli.dll", "C:\\Windows\\System32\\capauthz.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll", "C:\\Windows\\System32\\msasn1.dll", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\SysWOW64\\propsys.dll", "C:\\Windows\\System32\\propsys.dll", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\", "C:\\Users\\admin\\AppData\\Local\\Packages", "C:\\Users\\admin\\AppData\\Local\\Packages\\", "C:\\Users\\admin\\AppData\\Local\\", "C:\\Users\\admin\\AppData\\", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*", "\\??\\PhysicalDrive0", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\System32\\SecurityHealthHost.exe", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-18.pckgdep", "C:\\Windows\\ServiceProfiles\\", "C:\\Windows\\System32\\windows.storage.dll", "C:\\Windows\\System32\\wldp.dll", "C:\\Program Files (x86)", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\msedgeupdate.dll", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate.dll", "\\??\\PIPE\\wkssvc", "C:\\Windows\\System32\\omadmapi.dll", "C:\\Windows\\System32\\powrprof.dll", "C:\\Windows\\System32\\cryptsp.dll", "C:\\Windows\\System32\\DMCmnUtils.dll", "C:\\Windows\\System32\\ncrypt.dll", "C:\\Windows\\System32\\tbs.dll", "C:\\Windows\\System32\\umpdc.dll", "C:\\Windows\\System32\\ntasn1.dll", "C:\\Windows\\System32\\profapi.dll", "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead", "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", "C:\\MicrosoftEdgeUpdate.ini", "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log", "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3", "C:\\Windows\\System32\\kernel.appcore.dll", "\\Device\\CNG", "C:\\Program Files (x86)\\Microsoft", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\148.0.3967.83\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\148.0.3967.83\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Download\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\1.3.233.3\\*", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install", "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\*.*", "C:\\Windows\\System32\\userenv.dll", "C:\\Windows\\Temp", "C:\\Users\\admin\\AppData\\Local\\Temp", "C:\\Windows", "C:\\Windows\\System32", "C:\\Windows\\SysWOW64\\IntegratedServicesRegionPolicySet.json", "C:\\Windows\\System32\\IntegratedServicesRegionPolicySet.json", "\\Device\\DeviceApi\\CMApi", "C:\\Windows\\sysnative\\propsys.dll", "C:\\Windows\\System32\\en-US\\windows.storage.dll.mui", "C:\\Windows\\sysnative\\en-US\\windows.storage.dll.mui", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini\\desktop.ini", "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui", "C:\\Windows\\sysnative\\en-US\\PROPSYS.dll.mui", "C:\\Windows\\System32\\linkinfo.dll", "C:\\Program Files (x86)\\desktop.ini", "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", "C:\\Windows\\System32\\license.rtf", "\\??\\{4C572733-2FBA-4346-9601-F86DBA666EF2}", "C:\\Windows\\System32\\winsta.dll", "\\Device\\RasAcd", "C:\\Windows\\System32\\mswsock.dll", "C:\\Windows\\System32\\en-US\\mswsock.dll.mui", "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui", "C:\\Windows\\System32\\wshqos.dll", "C:\\Windows\\System32\\en-US\\wshqos.dll.mui", "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui", "C:\\Windows\\System32\\dnsapi.dll", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui", "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui", "C:\\Windows\\System32\\dpapi.dll", "C:\\Windows\\System32\\MsMpLics.dll", "C:\\ProgramData\\Microsoft\\Windows\\WER", "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp", "C:\\ProgramData\\Microsoft\\Windows", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\a6e4fa08-0880-4e40-b09b-bb389c339c38", "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\28c4bba8-9b4d-4ecd-9f53-ce7a8d27701a", "C:\\Windows\\System32\\Faultrep.dll", "C:\\Windows\\System32\\dbghelp.dll", "C:\\Windows\\System32\\dbgcore.dll", "C:\\Windows\\System32\\wer.dll", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\0d5844f8-11cb-4a90-804d-9eeed0bd5515", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c82e364e-9619-4e20-9837-f3d32208cbe0", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt", "C:\\Windows\\System32\\rpcss.dll", "C:\\Windows\\System32\\wtsapi32.dll", "C:\\Windows\\System32\\IPHLPAPI.DLL", "\\??\\Nsi", "C:\\Windows\\System32\\dusmapi.dll", "C:\\ProgramData\\Microsoft\\Windows\\OneSettings", "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\config.json", "C:\\ProgramData\\Microsoft\\Windows\\Models", "C:\\ProgramData\\Microsoft\\Windows\\OneSettings\\CTAC.json", "C:\\Windows\\System32\\en-US\\Windows.Web.dll.mui", "\\??\\TPM" ], "read_files": [], "write_files": [ "C:\\Users\\admin\\AppData\\Local\\Microsoft\\PenWorkspace\\DiscoverCacheData.dat", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", "\\??\\pipe\\crashpad_4104_VNIRRYNIERXILDVP", "\\??\\PIPE\\wkssvc", "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log", "\\Device\\RasAcd", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\a6e4fa08-0880-4e40-b09b-bb389c339c38", "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\28c4bba8-9b4d-4ecd-9f53-ce7a8d27701a", "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\0d5844f8-11cb-4a90-804d-9eeed0bd5515", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c82e364e-9619-4e20-9837-f3d32208cbe0", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt", "\\??\\TPM" ], "delete_files": [ "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp", "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp" ], "keys": [ "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32", "HKEY_CURRENT_USER\\Software\\Classes", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_USERS", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager", "HKEY_CLASSES_ROOT\\Directory", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\Folder", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\AllFilesystemObjects", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Provisioning\\OMADM\\Accounts", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Provisioning\\OMADM\\Accounts", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\My", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CRLs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\CTLs", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My\\PhysicalStores", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\My", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Copilot", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\EdgeUpdate\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\edgeupdate_service_name", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\edgeupdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\edgeupdate\\Alias", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\Software\\Classes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\MicrosoftEdgeUpdate.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\MicrosoftEdgeUpdate.exe\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00020400-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00020420-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\Elevation", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\DefaultUserEnviroment", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Environment", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Volatile Environment\\0", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PropertyBag", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32\\(Default)", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\MicrosoftEdgeUpdate.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\CLASSES", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer", "HKEY_USERS\\.DEFAULT\\Software\\Policies\\Microsoft\\Windows\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\0", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers\\.json", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\OpenWithProgids", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.json\\OpenWithProgids", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.fileTypeAssociation\\.json", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\CurVer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\SystemIndexNormalization", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\NeverShowExt", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name", "HKEY_USERS\\", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NormalizeLinkNetPidls", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\CurVer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InactivityBadgeApplied", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-19\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-20\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\InternetRegistry\\REGISTRY\\USER\\S-1-5-18\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallerProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallerProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oeminstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oeminstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfHost\\Applicability", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_USERS\\.DEFAULT\\Environment", "HKEY_USERS\\.DEFAULT\\Volatile Environment", "HKEY_USERS\\.DEFAULT\\Volatile Environment\\0", "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo", "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_labels", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\\PersistedPingString", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\\PersistedPingTime", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppPingSent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppHint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppInstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppCohort", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WinInit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OOBEDiagnosticsSent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\rollbackrequested", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_control_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\rollbackrequested", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdateDev\\CdpNames\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Clients\\StartMenuInternet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\proxy", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ConsecutiveCheckFailures", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastChecked", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\State", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{753D568D-CA29-4956-AA4C-D2F6B81FE1F8}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\SecurityService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\SecurityService\\DefaultAuthLevel", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings\\updatecheck_succeeded_ms", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_succeeded", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_total", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_uac_disabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_windows_installing", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\worker_shell_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\omaha_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\is_system_install", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\windows_major_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\opt_in_uid_generated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\last_checked", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sList", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sDecimal", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sThousand", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sGrouping", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNativeDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonDecimalSep", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonThousandSep", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonGrouping", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sPositiveSign", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNegativeSign", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sTimeFormat", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortTime", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s1159", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s2359", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortDate", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sYearMonth", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sLongDate", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCountry", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iMeasure", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iPaperSize", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iLZero", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegNumber", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\NumShape", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrency", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegCurr", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstDayOfWeek", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstWeekOfYear", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sCurrency", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCalendarType", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Gregorian", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\CommercialId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode", "HKEY_LOCAL_MACHINE\\System\\Setup", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\AllowAutoWindowsUpdateDownloadOverMeteredNetwork", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\allowautoupdatesmetered", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\allowautoupdatesmetered", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ECSExpiryConfig", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E", "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\opv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\opv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\opv", "HKEY_CLASSES_ROOT\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0000000C-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SCMConfig", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\EnableSvchostMitigationPolicy", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\PerfTrack\\TraceProfile", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\SvchostHeapReportingThresholdInKB", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\wersvc", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Alias", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceManifest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceMain", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\LegacyCOMBehavior", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ServiceTimeout", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoReflection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\DefaultUserEnviroment", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\TermReason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\CreationTime", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDllUnloadOnStop", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\edgeupdate_service_name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\edgeupdate\\Alias", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\MicrosoftEdgeUpdate.exe\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\AppID", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RegistrationUpdateHook", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InitFolderHandler", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\SystemIndexNormalization", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.json", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NormalizeLinkNetPidls", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InactivityBadgeApplied", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oobeinstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatecount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oeminstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oeminstall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppPingSent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppHint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppInstallTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ExternalAppCohort", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OOBEDiagnosticsSent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\rollbackrequested", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\experiment_control_labels", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\rollbackrequested", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\optedintoinsider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatefreqhourshint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\SecurityService\\DefaultAuthLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings\\updatecheck_succeeded_ms", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_succeeded", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_total", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\opt_in_uid_generated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sList", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sDecimal", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sThousand", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sGrouping", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNativeDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonDecimalSep", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonThousandSep", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sMonGrouping", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sPositiveSign", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sNegativeSign", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sTimeFormat", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortTime", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s1159", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\s2359", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sShortDate", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sYearMonth", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sLongDate", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCountry", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iMeasure", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iPaperSize", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iLZero", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegNumber", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\NumShape", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrDigits", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCurrency", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iNegCurr", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstDayOfWeek", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iFirstWeekOfYear", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\sCurrency", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\iCalendarType", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\CommercialId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode", "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\AllowAutoWindowsUpdateDownloadOverMeteredNetwork", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\allowautoupdatesmetered", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\consentcommunicated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\urlstats", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\previousedgepreviewvalue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\edgepreviewdisenrollreason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\allowautoupdatesmetered", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ECSExpiryConfig", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version", "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103", "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\3\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\F8A408B8FBEEA077B75738658641BE77154720EB", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\opv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\opv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\opv", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\EnableSvchostMitigationPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\SvchostHeapReportingThresholdInKB", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Alias", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDll", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceManifest", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceMain", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\LegacyCOMBehavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ServiceTimeout", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoReflection", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\CreationTime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\CreationTime", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDllUnloadOnStop", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" ], "write_keys": [ "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\\PersistedPingString", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\\PersistedPingTime", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ConsecutiveCheckFailures", "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LatestRecommendedVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\LastCheckSuccess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastChecked", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState\\StateValue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Timings\\updatecheck_succeeded_ms", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_succeeded", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\worker_update_check_total", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_uac_disabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\worker_is_windows_installing", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\worker_shell_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\omaha_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\is_system_install", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\windows_major_version", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\opt_in_uid_generated", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\last_checked" ], "delete_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallerProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallerProgress", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\UpdateAvailableSince", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\UpdateAvailableSince" ], "executed_commands": [ "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff16f35d58,0x7fff16f35d64,0x7fff16f35d70", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2388,i,8823613399287029355,12022979517610140969,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,16090793344968355769,14585619003076371751,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2440 /prefetch:2", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,17890292518401804609,7034942189224193145,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2764 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186407985 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3560,i,11676548911406118748,16820735849445238907,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3556 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186410130 --skip-read-main-dll --metrics-shmem-handle=3668,i,2396491602889113873,12485579353753644802,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3748 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5328,i,12626311780650901669,14176311243473770968,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5368 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5340,i,17745413209609224926,8469148961402733420,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5428 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,13601508909079690424,398805377896742876,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3676 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=219783184 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6168,i,11591325124669200099,14631802058767790145,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1624 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5412,i,5337591086858526967,16474943761420232357,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6432 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4004,i,7092498328383177707,8111344416296456205,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3448 /prefetch:8", "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc", "C:\\Windows\\system32\\sppsvc.exe", "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup", "C:\\Windows\\system32\\svchost.exe -k netsvcs -p", "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4", "C:\\Windows\\system32\\WerFault.exe -pss -s 688 -p 8756 -ip 8756", "C:\\Windows\\system32\\WerFault.exe -u -p 8756 -s 284" ], "resolved_apis": [], "mutexes": [ "Local\\SM0:9656:304:WilStaging_02", "Local\\SM0:9656:120:WilError_03", "__OMADM_NAMED_MUTEX__", "_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log", "Global\\EdgeUpdate{76524F9B-42D7-48C8-B7DF-FAB9E93834BF}", "Global\\EdgeUpdate{9FE41F29-8211-488D-B96A-81FCD0A8ACE3}", "Global\\EdgeUpdate{8A5FF6DC-FF03-4CB3-8834-D3AD1DE301DF}", "Local\\SM0:5932:168:WilStaging_02", "Local\\SM0:5932:64:WilError_03", "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}", "Global\\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}", "Local\\SM0:11836:120:WilError_03", "Local\\SM0:11836:304:WilStaging_02", "Local\\SM0:13492:304:WilStaging_02" ], "created_services": [], "started_services": [ "edgeupdate", "wisvc" ] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 1, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 2, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 3, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 4, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 5, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 6, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 7, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 8, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 9, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 10, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 11, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 12, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 13, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,126", "eid": 14, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 15, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 16, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 17, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 18, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 19, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 20, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 21, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 22, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 23, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 24, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 25, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 26, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 27, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 28, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 29, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 30, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 31, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 32, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,141", "eid": 33, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 34, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 35, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 36, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 37, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 38, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 39, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 40, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 41, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 42, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 43, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 44, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 45, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 46, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 47, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 48, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 49, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 50, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 51, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 52, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 53, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 54, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 55, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 56, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 57, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 58, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 59, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 60, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 61, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 62, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 63, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,157", "eid": 64, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 65, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 66, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 67, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 68, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 69, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,188", "eid": 70, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 71, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 72, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 73, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 74, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 75, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 76, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 77, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 78, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 79, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 80, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 81, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 82, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 83, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 84, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 85, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 86, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 87, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 88, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 89, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 90, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 91, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 92, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 93, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 94, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,266", "eid": 95, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 96, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 97, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 98, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 99, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 100, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 101, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 102, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 103, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 104, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 105, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 106, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 107, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 108, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 109, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 110, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 111, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 112, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 113, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 114, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 115, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 116, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 117, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 118, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 119, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,282", "eid": 120, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 121, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 122, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 123, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 124, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 125, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 126, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 127, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:13,297", "eid": 128, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:14,376", "eid": 129, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:14,376", "eid": 130, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:22,547", "eid": 131, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:22,547", "eid": 132, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:22,547", "eid": 133, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:22,563", "eid": 134, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:23,891", "eid": 135, "data": { "file": "user32", "pathtofile": null, "moduleaddress": "0x7fff581b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:27,751", "eid": 136, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": "0x7fff44d50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,422", "eid": 137, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,688", "eid": 138, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,688", "eid": 139, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,688", "eid": 140, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,719", "eid": 141, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,751", "eid": 142, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,766", "eid": 143, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,797", "eid": 144, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,829", "eid": 145, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,829", "eid": 146, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,829", "eid": 147, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,844", "eid": 148, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,876", "eid": 149, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,891", "eid": 150, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,922", "eid": 151, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,954", "eid": 152, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:41,110", "eid": 153, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:41,110", "eid": 154, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:41,219", "eid": 155, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:45,126", "eid": 156, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:45,141", "eid": 157, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:03,735", "eid": 158, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,797", "eid": 159, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,797", "eid": 160, "data": { "file": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff4c1e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,797", "eid": 161, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,797", "eid": 162, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,813", "eid": 163, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,813", "eid": 164, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,032", "eid": 165, "data": { "file": "D3D10Warp.dll", "pathtofile": null, "moduleaddress": "0x7fff4faa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,032", "eid": 166, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,032", "eid": 167, "data": { "file": "d3d10warp.dll", "pathtofile": null, "moduleaddress": "0x7fff4faa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,063", "eid": 168, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,063", "eid": 169, "data": { "file": "D3D10Warp.dll", "pathtofile": null, "moduleaddress": "0x7fff4faa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,063", "eid": 170, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,063", "eid": 171, "data": { "file": "d3d10warp.dll", "pathtofile": null, "moduleaddress": "0x7fff4faa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,063", "eid": 172, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:23,688", "eid": 173, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:23,704", "eid": 174, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,766", "eid": 175, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,766", "eid": 176, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,782", "eid": 177, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,782", "eid": 178, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,813", "eid": 179, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,876", "eid": 180, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,969", "eid": 181, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,985", "eid": 182, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:49,032", "eid": 183, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:49,032", "eid": 184, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:49,032", "eid": 185, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:49,032", "eid": 186, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,284", "eid": 187, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff16f35d58,0x7fff16f35d64,0x7fff16f35d70" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,378", "eid": 188, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2388,i,8823613399287029355,12022979517610140969,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,393", "eid": 189, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,16090793344968355769,14585619003076371751,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2440 /prefetch:2" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,424", "eid": 190, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,17890292518401804609,7034942189224193145,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2764 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,518", "eid": 191, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186407985 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3560,i,11676548911406118748,16820735849445238907,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3556 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:22,518", "eid": 192, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186410130 --skip-read-main-dll --metrics-shmem-handle=3668,i,2396491602889113873,12485579353753644802,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3748 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:27,581", "eid": 193, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5328,i,12626311780650901669,14176311243473770968,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5368 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:27,596", "eid": 194, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5340,i,17745413209609224926,8469148961402733420,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5428 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:30,331", "eid": 195, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:52,378", "eid": 196, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,13601508909079690424,398805377896742876,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3676 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:55,893", "eid": 197, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=219783184 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6168,i,11591325124669200099,14631802058767790145,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1624 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,424", "eid": 198, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5412,i,5337591086858526967,16474943761420232357,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6432 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:46:22,362", "eid": 199, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4004,i,7092498328383177707,8111344416296456205,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3448 /prefetch:8" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 200, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 201, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 202, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 203, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 204, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 205, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 206, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 207, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 208, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 209, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 210, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 211, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 212, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 213, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 214, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 215, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 216, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,735", "eid": 217, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,735", "eid": 218, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,735", "eid": 219, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": "stable" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 221, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 222, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 224, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,751", "eid": 226, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,751", "eid": 227, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,751", "eid": 229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,751", "eid": 230, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,751", "eid": 231, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,766", "eid": 232, "data": { "file": "api-ms-win-core-file-l1-2-1.dll", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,766", "eid": 233, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 234, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 235, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 236, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 237, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 238, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 239, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 240, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 241, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 242, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 243, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 244, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 245, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 246, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 247, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 248, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 249, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,891", "eid": 250, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 251, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff58070000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 252, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 253, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 254, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 255, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 256, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,891", "eid": 257, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 258, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 259, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 260, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 261, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 262, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 263, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 264, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 265, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 266, "data": { "file": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "pathtofile": null, "moduleaddress": "0x25931000000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 267, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 268, "data": { "file": "ucrtbase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 269, "data": { "file": "ADVAPI32.dll", "pathtofile": null, "moduleaddress": "0x7fff599c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 270, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 271, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7fff54fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 272, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,922", "eid": 273, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 274, "data": { "file": "Kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,922", "eid": 275, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,922", "eid": 276, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,922", "eid": 277, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 278, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,938", "eid": 279, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 280, "data": { "file": "USER32.dll", "pathtofile": null, "moduleaddress": "0x7fff581b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 281, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 282, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 283, "data": { "file": "api-ms-win-core-wow64-l1-1-1.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,938", "eid": 284, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "3803" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:30,938", "eid": 285, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "content": "22H2" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 286, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 287, "data": { "file": "Kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,938", "eid": 288, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,954", "eid": 289, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,954", "eid": 290, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 291, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 292, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 293, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 294, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 295, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 296, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 297, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 298, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 299, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,954", "eid": 300, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 301, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 302, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 303, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 304, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 305, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 306, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:30,969", "eid": 307, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 308, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 309, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 310, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 311, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 312, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 313, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 314, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 315, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 316, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 317, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 318, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 319, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 320, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 321, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 322, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:30,969", "eid": 323, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:31,126", "eid": 324, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:31,126", "eid": 325, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:31,126", "eid": 326, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:31,141", "eid": 327, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:31,141", "eid": 328, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,141", "eid": 329, "data": { "file": "api-ms-win-core-winrt-string-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff584a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,141", "eid": 330, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,141", "eid": 331, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "content": "C:\\Windows\\System32\\execmodelclient.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 338, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 340, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 341, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,141", "eid": 344, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,141", "eid": 345, "data": { "file": "C:\\Windows\\System32\\execmodelclient.dll", "pathtofile": null, "moduleaddress": "0x7fff46d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,141", "eid": 346, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 347, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 348, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 349, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "content": "C:\\Windows\\System32\\combase.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 350, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 351, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 352, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 353, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 354, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 355, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 356, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 357, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 358, "data": { "file": "C:\\Windows\\System32\\combase.dll", "pathtofile": null, "moduleaddress": "0x7fff584a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 359, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 360, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": "0x7fff59330000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 361, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,157", "eid": 373, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 374, "data": { "file": "C:\\Windows\\System32\\twinapi.appcore.dll", "pathtofile": null, "moduleaddress": "0x7fff517c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 375, "data": { "file": "C:\\Windows\\System32\\wpnapps.dll", "pathtofile": null, "moduleaddress": "0x7fff40fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,157", "eid": 376, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 377, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 378, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 379, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32\\(Default)", "content": "{b03c2205-f02e-4d77-80df-e1747afdd39c}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": "ExecModelProxy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 387, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 388, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": "Windows Push Notification Developer Proxy Stub" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 391, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": "ExecModelProxy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 392, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 394, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 395, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 396, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 397, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 398, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 399, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,172", "eid": 400, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 401, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 402, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 403, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": "Windows Push Notification Developer Proxy Stub" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,188", "eid": 404, "data": { "file": "C:\\Windows\\System32\\execmodelproxy.dll", "pathtofile": null, "moduleaddress": "0x7fff46ae0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,188", "eid": 405, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 406, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 407, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 408, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 409, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 410, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 411, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,188", "eid": 412, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 413, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 414, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 415, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 416, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 417, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 418, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_UserInControlOfTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 419, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 420, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 422, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 423, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 424, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 425, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 426, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 427, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 428, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 429, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 430, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 431, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": "Windows Push Notification Platform" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 432, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 433, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 434, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 435, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 436, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 437, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 440, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 441, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 442, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 447, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 448, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 456, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 461, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 462, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 463, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 464, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 465, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 466, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,204", "eid": 474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 475, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 476, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 477, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 478, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 479, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 480, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,219", "eid": 481, "data": { "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff50870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,219", "eid": 482, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 483, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 484, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 485, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 488, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 489, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 490, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 491, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 492, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 493, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 494, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 495, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 496, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 497, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,219", "eid": 498, "data": { "file": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x7fff4cbf0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,219", "eid": 499, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,219", "eid": 500, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 501, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 502, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 503, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 504, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 505, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 506, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 507, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 508, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 509, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,235", "eid": 510, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 511, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 512, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 517, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 521, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 522, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_UserInControlOfTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 524, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:31,251", "eid": 525, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 527, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff58070000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 528, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 530, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 531, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 532, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 533, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 536, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 540, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 541, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 543, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 544, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 545, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 547, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 548, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 550, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 551, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 552, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 553, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 554, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 555, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 556, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 557, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 559, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 560, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 561, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 562, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 566, "data": { "file": "C:\\Windows\\System32\\Windows.ApplicationModel.dll", "pathtofile": null, "moduleaddress": "0x7fff457f0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 567, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 573, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 579, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 580, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 581, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 582, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 583, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 585, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 586, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 588, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 589, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 590, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,251", "eid": 591, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 593, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 594, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,251", "eid": 595, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,266", "eid": 596, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,266", "eid": 597, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,266", "eid": 598, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": "04c19204-10d9-450a-95c4-2910c8f72be3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 608, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 609, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 610, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 611, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,266", "eid": 612, "data": { "file": "C:\\Windows\\System32\\CryptoWinRT.dll", "pathtofile": null, "moduleaddress": "0x2592ff50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,266", "eid": 613, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 614, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 615, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 616, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 617, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 618, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 619, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 620, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 621, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 622, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 623, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 624, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 625, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 626, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 627, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 628, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 629, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 630, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 631, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 632, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,266", "eid": 633, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 634, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 635, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 636, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 637, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 639, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "content": "C:\\Windows\\System32\\twinapi.appcore.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 641, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 642, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 643, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 644, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 645, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 646, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:31,282", "eid": 647, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:31,282", "eid": 648, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 649, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 650, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 651, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 652, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 653, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 654, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 656, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,344", "eid": 660, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x7fff52dc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,344", "eid": 661, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,344", "eid": 663, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 665, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 668, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 672, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 673, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 674, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 675, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 676, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 677, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 678, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 679, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 680, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 681, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 682, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 685, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,344", "eid": 686, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff58070000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,344", "eid": 687, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 688, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 689, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 690, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 691, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 692, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "content": "0" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,344", "eid": 693, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 694, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 695, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 696, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 697, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 698, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 699, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 700, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 701, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 702, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 703, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 704, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 705, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 706, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 707, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,344", "eid": 708, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 709, "data": { "file": "C:\\Windows\\System32\\TileDataRepository.dll", "pathtofile": null, "moduleaddress": "0x7fff43150000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 710, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 711, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 712, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 713, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 714, "data": { "file": "C:\\Windows\\System32\\biwinrt.dll", "pathtofile": null, "moduleaddress": "0x7fff3d7b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 715, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 716, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 717, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 718, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 719, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 720, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 721, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 725, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "content": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 727, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 728, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 729, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 730, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 731, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 732, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 733, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 734, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 736, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 737, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 738, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 739, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 740, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 741, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 744, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 745, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 746, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 747, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 748, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 749, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 750, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 751, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 752, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 753, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 754, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 755, "data": { "file": "C:\\Windows\\System32\\usermgrproxy.dll", "pathtofile": null, "moduleaddress": "0x7fff4f6e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,360", "eid": 756, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 757, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 758, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 759, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 760, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 761, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 762, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 763, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 764, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 765, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 766, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 767, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 768, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 769, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 770, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 771, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 772, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 773, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,360", "eid": 774, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 775, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 776, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 777, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 778, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 779, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 780, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 781, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 782, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 783, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 784, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 785, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 786, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 787, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 788, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 789, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 790, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 791, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 792, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 793, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 794, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 795, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 799, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 800, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 807, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 809, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 810, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 811, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 812, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 813, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:33,376", "eid": 814, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 815, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,376", "eid": 817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,391", "eid": 818, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 819, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 820, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 821, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 822, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 823, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 824, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 825, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 826, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 827, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 828, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 829, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 830, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 831, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 832, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 833, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 834, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 835, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 836, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 837, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 838, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 839, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,391", "eid": 840, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,407", "eid": 841, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,407", "eid": 842, "data": { "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll", "pathtofile": null, "moduleaddress": "0x7fff3d6a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,407", "eid": 843, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,407", "eid": 844, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,407", "eid": 845, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "content": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,407", "eid": 846, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,407", "eid": 847, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 848, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 849, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 852, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 853, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 855, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 856, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 857, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 858, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 859, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 860, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,422", "eid": 861, "data": { "file": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff43060000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,422", "eid": 862, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,422", "eid": 863, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 864, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 865, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 866, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 867, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 868, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 869, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 870, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 873, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 875, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 876, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 877, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 878, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 879, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 880, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 881, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 882, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 883, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 884, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 885, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 886, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,422", "eid": 887, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 888, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 889, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 890, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 891, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 892, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 893, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 894, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 895, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 896, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 897, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 898, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 899, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 900, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 901, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 902, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 903, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 904, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 905, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 906, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 907, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 908, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 909, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 910, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 911, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,438", "eid": 912, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 913, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 914, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 915, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 916, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\StartTileData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 917, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 918, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 919, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 920, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 921, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 922, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 923, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,454", "eid": 924, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,469", "eid": 925, "data": { "file": "C:\\Windows\\System32\\StartTileData.dll", "pathtofile": null, "moduleaddress": "0x7fff43dd0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,469", "eid": 926, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,469", "eid": 927, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,469", "eid": 928, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,469", "eid": 929, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,469", "eid": 930, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,469", "eid": 931, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,485", "eid": 932, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 933, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 934, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 935, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "content": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 936, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 937, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 938, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 939, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 940, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 941, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 942, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 943, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,485", "eid": 944, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll", "pathtofile": null, "moduleaddress": "0x7fff3d810000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,485", "eid": 945, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 946, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "content": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 947, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 948, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 949, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 950, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 951, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,485", "eid": 952, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,485", "eid": 953, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 954, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 955, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,501", "eid": 959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 962, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 963, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "content": "1581568" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 964, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 965, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,516", "eid": 966, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,516", "eid": 967, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,579", "eid": 968, "data": { "file": "C:\\Windows\\System32\\mssprxy.dll", "pathtofile": null, "moduleaddress": "0x7fff4cd40000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,579", "eid": 969, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,579", "eid": 970, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,594", "eid": 971, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7fff52860000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,594", "eid": 972, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 973, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 974, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 975, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 977, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 978, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,594", "eid": 980, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,610", "eid": 981, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,610", "eid": 982, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 983, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 984, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 985, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 986, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 987, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 988, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 989, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 990, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 992, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 993, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 994, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 995, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 996, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 997, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 998, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 999, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1000, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1001, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1002, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1003, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1004, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1005, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1006, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1007, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1008, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1009, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1010, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1011, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1012, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1014, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1015, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1018, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1020, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1021, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1022, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,626", "eid": 1024, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1025, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1026, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "content": "Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1027, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1030, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1031, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1032, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1033, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1034, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1036, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1046, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "content": "Common Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "content": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1055, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1056, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1057, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1058, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1060, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "content": "%ProgramData%\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1069, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1070, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "content": "Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1073, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "content": "Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1074, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1075, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "content": "@shell32,dll,-12692" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1076, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21797" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1077, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-117" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1078, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1079, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1080, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1082, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1083, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1084, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1085, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,641", "eid": 1086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1089, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1090, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1091, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1092, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "content": "Windows" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1093, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1096, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1097, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1098, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1099, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1101, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1102, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1103, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1104, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1105, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1106, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1107, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1108, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1109, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1110, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1111, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1112, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1113, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "content": "System" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1114, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1115, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1116, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1119, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1122, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1123, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1131, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1132, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1133, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1134, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "content": "Personal" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1135, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1137, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "content": "Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1138, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "content": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1139, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1140, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "content": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1141, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-112" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1142, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,657", "eid": 1153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1154, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "content": "%USERPROFILE%\\Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1155, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1156, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "content": "Fonts" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1157, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "content": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1161, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1164, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1167, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1168, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1169, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1170, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1171, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1172, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1173, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:33,672", "eid": 1176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "content": "32" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:33,672", "eid": 1177, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x7fff55710000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,688", "eid": 1178, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:33,688", "eid": 1179, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:33,688", "eid": 1180, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:38,688", "eid": 1181, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:38,688", "eid": 1182, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:38,704", "eid": 1183, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:38,704", "eid": 1184, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:43,719", "eid": 1185, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:43,719", "eid": 1186, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:43,719", "eid": 1187, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:43,719", "eid": 1188, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:43,719", "eid": 1189, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:43,719", "eid": 1190, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4104.9524.10242803108607437" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:39,690", "eid": 1191, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:40,190", "eid": 1192, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:40,268", "eid": 1193, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:40,299", "eid": 1194, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:40,331", "eid": 1195, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "start", "object": "service", "timestamp": "2026-05-29 10:44:50,331", "eid": 1196, "data": { "service": "edgeupdate" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:20,831", "eid": 1197, "data": { "file": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,487", "eid": 1198, "data": { "file": "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca" } }, { "event": "start", "object": "service", "timestamp": "2026-05-29 10:45:43,549", "eid": 1199, "data": { "service": "wisvc" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:48,862", "eid": 1200, "data": { "file": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:46:22,393", "eid": 1201, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:44:50,004", "eid": 1202, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,254", "eid": 1203, "data": { "file": "C:\\Windows\\system32\\sppsvc.exe" } }, { "event": "start", "object": "service", "timestamp": "2026-05-29 10:45:22,285", "eid": 1204, "data": { "service": "" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,316", "eid": 1205, "data": { "file": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:43,472", "eid": 1206, "data": { "file": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1207, "data": { "file": "C:\\lpw_albt\\dll\\nxatNo.dll", "pathtofile": null, "moduleaddress": "0x6ab90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1208, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1209, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1210, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1211, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1212, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1213, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1214, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1215, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1216, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1217, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1218, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1219, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,190", "eid": 1220, "data": { "file": "SHELL32.dll", "pathtofile": null, "moduleaddress": "0x768c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,206", "eid": 1221, "data": { "file": "api-ms-win-eventing-provider-l1-1-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,206", "eid": 1222, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,206", "eid": 1223, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,221", "eid": 1224, "data": { "file": "ADVAPI32.dll", "pathtofile": null, "moduleaddress": "0x75e50000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,221", "eid": 1225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,221", "eid": 1226, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": "1.3.233.3" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,221", "eid": 1227, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,221", "eid": 1228, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1229, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1230, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1231, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1232, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x75f90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1233, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1234, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1235, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1236, "data": { "file": "SHLWAPI.dll", "pathtofile": null, "moduleaddress": "0x76180000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1237, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x75f90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1238, "data": { "file": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate.dll", "pathtofile": null, "moduleaddress": "0x6aeb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1239, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1240, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1241, "data": { "file": "C:\\Windows\\System32\\kernel32.dll", "pathtofile": null, "moduleaddress": "0x75f90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1242, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1243, "data": { "file": "SHELL32.dll", "pathtofile": null, "moduleaddress": "0x768c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1244, "data": { "file": "ADVAPI32.dll", "pathtofile": null, "moduleaddress": "0x75e50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1245, "data": { "file": "C:\\Windows\\System32\\kernel32.dll", "pathtofile": null, "moduleaddress": "0x75f90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,237", "eid": 1246, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,237", "eid": 1247, "data": { "file": "\\Device\\NamedPipe\\wkssvc" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:50,237", "eid": 1248, "data": { "file": "\\Device\\NamedPipe\\wkssvc" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,253", "eid": 1249, "data": { "file": "C:\\Windows\\System32\\MDMRegistration.dll", "pathtofile": null, "moduleaddress": "0x755e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,253", "eid": 1250, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1251, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1252, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1253, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1254, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1255, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1256, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1257, "data": { "file": "C:\\Windows\\System32\\netapi32.dll", "pathtofile": null, "moduleaddress": "0x70670000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,268", "eid": 1258, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1259, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1260, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1261, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1262, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1263, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,284", "eid": 1264, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,299", "eid": 1265, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,299", "eid": 1266, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1267, "data": { "file": "C:\\Windows\\System32\\netapi32.dll", "pathtofile": null, "moduleaddress": "0x70670000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1268, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1269, "data": { "file": "api-ms-win-eventing-provider-l1-1-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1270, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1271, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1272, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1273, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1274, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1275, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1276, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1277, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1278, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,299", "eid": 1279, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1280, "data": { "file": "netapi32.dll", "pathtofile": null, "moduleaddress": "0x70670000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,299", "eid": 1281, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,299", "eid": 1282, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,299", "eid": 1283, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1284, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1285, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1286, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,315", "eid": 1287, "data": { "file": "USER32.dll", "pathtofile": null, "moduleaddress": "0x75810000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1288, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1289, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1290, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1291, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1292, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:50,315", "eid": 1293, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,315", "eid": 1294, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,331", "eid": 1295, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,331", "eid": 1296, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\edgeupdate_service_name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,331", "eid": 1297, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\edgeupdate\\Alias", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,331", "eid": 1298, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": "0x75720000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,331", "eid": 1299, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1300, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1301, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1302, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1303, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1304, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1305, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1306, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,346", "eid": 1307, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\MicrosoftEdgeUpdate.exe\\AppId", "content": "{A6B716CB-028B-404D-B72C-50E153DD68DA}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1308, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1309, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1310, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\\(Default)", "content": "Update3COMClass" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,362", "eid": 1311, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1312, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,362", "eid": 1313, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1314, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1315, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1316, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1317, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1318, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1319, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1320, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "content": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\psmachine.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1321, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1322, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1323, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1324, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1325, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1326, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1327, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\(Default)", "content": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\psmachine.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1328, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,362", "eid": 1329, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1330, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1331, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1332, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1333, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1334, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x77390000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1335, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x75f90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1336, "data": { "file": "SHLWAPI.dll", "pathtofile": null, "moduleaddress": "0x76180000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1337, "data": { "file": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\psmachine.dll", "pathtofile": null, "moduleaddress": "0x755e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1338, "data": { "file": "RPCRT4.dll", "pathtofile": null, "moduleaddress": "0x766d0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00020420-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1340, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1341, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "content": "PSDispatch" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1344, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1345, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\oleaut32.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1346, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1347, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1348, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1349, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)", "content": "PSDispatch" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1350, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1351, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1352, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\oleaut32.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1353, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,378", "eid": 1354, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1355, "data": { "file": "C:\\Windows\\SysWOW64\\oleaut32.dll", "pathtofile": null, "moduleaddress": "0x76810000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,378", "eid": 1356, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,565", "eid": 1357, "data": { "file": "OLEAUT32.dll", "pathtofile": null, "moduleaddress": "0x76810000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,565", "eid": 1358, "data": { "file": "OLEAUT32.dll", "pathtofile": null, "moduleaddress": "0x76810000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1359, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1360, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RegistrationUpdateHook", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1361, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RegistrationUpdateHook", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RegistrationUpdateHook", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\DllPath", "content": "C:\\Windows\\System32\\SystemSettings.DataModel.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1373, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.System.Profile.RegionPolicyEvaluator\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,862", "eid": 1374, "data": { "file": "C:\\Windows\\System32\\SystemSettings.DataModel.dll", "pathtofile": null, "moduleaddress": "0x75580000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,862", "eid": 1375, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1376, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1377, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1378, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\DllPath", "content": "%SystemRoot%\\system32\\windows.storage.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1379, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,862", "eid": 1386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFile\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,862", "eid": 1387, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x74a60000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1388, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1389, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1391, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": "%SystemDrive%\\ProgramData" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1392, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": "%SystemDrive%\\Users\\Public" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1394, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1395, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": "%SystemDrive%\\Users\\Default" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1396, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1397, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1398, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1399, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1400, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1401, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1402, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1403, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1404, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1405, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": "C:\\Program Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1406, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1407, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": "C:\\Program Files\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1408, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1409, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1410, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1411, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": "%USERPROFILE%\\AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1412, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1413, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1414, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1415, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1416, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1417, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1418, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1419, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1420, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Name", "content": "LocalAppDataLow" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1422, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1423, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\RelativePath", "content": "AppData\\LocalLow" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1424, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1425, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1426, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1427, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1428, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Security", "content": "S:(ML;OICI;NW;;;LW)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1429, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1430, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1431, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\LocalRedirectOnly", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1432, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1433, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1434, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1435, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\PublishExpandedPath", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1436, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1437, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\Attributes", "content": "8192" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1440, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1441, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1442, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": "%SystemDrive%\\ProgramData" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": "%SystemDrive%\\Users\\Public" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": "%SystemDrive%\\Users\\Default" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1447, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1448, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1456, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": "C:\\Program Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": "C:\\Program Files\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1461, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1462, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": "%USERPROFILE%\\AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1463, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1464, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1465, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1466, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1469, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name", "content": "Profile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1475, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1476, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1477, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1478, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1479, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1480, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1481, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1482, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1483, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1484, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1485, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1488, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1489, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1490, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1491, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1492, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1493, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1494, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1495, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\DllPath", "content": "%SystemRoot%\\system32\\windows.storage.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1496, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1497, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1498, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1499, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1500, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1501, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1502, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1503, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,878", "eid": 1504, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.StorageFileStaticsBrokered\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1505, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1506, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1507, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1508, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1509, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1510, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1511, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1512, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1517, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1521, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1522, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,893", "eid": 1523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,893", "eid": 1524, "data": { "file": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x6fcf0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1525, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1527, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "content": "C:\\Windows\\System32\\combase.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1528, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1530, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1531, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1532, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1533, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,909", "eid": 1536, "data": { "file": "C:\\Windows\\System32\\combase.dll", "pathtofile": null, "moduleaddress": "0x76e80000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,909", "eid": 1537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,924", "eid": 1540, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1541, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1543, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1544, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1545, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1547, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1548, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1550, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "content": "1581568" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1551, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1552, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,924", "eid": 1553, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1554, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "content": "32" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1555, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1556, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1557, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1559, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1560, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1561, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1562, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1566, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1567, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,940", "eid": 1573, "data": { "file": "C:\\Windows\\System32\\StructuredQuery.dll", "pathtofile": null, "moduleaddress": "0x754f0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "content": "Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1579, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1580, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1581, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1582, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1583, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1585, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1586, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1588, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1589, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1590, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1591, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1593, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1594, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,940", "eid": 1595, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1596, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1597, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "content": "Common Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1598, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "content": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1608, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1609, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1610, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1611, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1612, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1613, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1614, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1615, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1616, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1617, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "content": "%ProgramData%\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1618, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1619, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "content": "Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1620, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1621, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1622, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "content": "Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1623, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1624, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "content": "@shell32,dll,-12692" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1625, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21797" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1626, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-117" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1627, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1628, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1629, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1630, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1631, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1632, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1633, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1634, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1635, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1636, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1637, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1639, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1641, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "content": "Windows" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1642, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1643, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1644, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1645, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1646, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1647, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1648, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1649, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1650, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1651, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1652, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1653, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1654, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1656, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1660, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1661, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "content": "System" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1663, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1665, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1668, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1672, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1673, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1674, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1675, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1676, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1677, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1678, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1679, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1680, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1681, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,956", "eid": 1682, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1685, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1686, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1687, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1688, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1689, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1690, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1691, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1692, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1693, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1694, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1695, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1696, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1697, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1698, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1699, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1700, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1701, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1702, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1703, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,956", "eid": 1704, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1705, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1706, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1707, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1708, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1709, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1710, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1711, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1712, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1713, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1714, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1715, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1716, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1717, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1718, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1719, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,971", "eid": 1720, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,971", "eid": 1721, "data": { "file": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x6aaf0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,987", "eid": 1722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,987", "eid": 1723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\SystemPropertyHandlers\\.json", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:50,987", "eid": 1724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:50,987", "eid": 1725, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x777a0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1727, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,003", "eid": 1728, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x70910000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1729, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\SystemIndexNormalization", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1730, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.json", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1731, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type", "content": "application/json" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1732, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1733, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\PerceivedType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1734, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1736, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1737, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1738, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\Content Type", "content": "application/json" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1739, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1740, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1741, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.json\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,003", "eid": 1744, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Unknown\\NeverShowExt", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,018", "eid": 1745, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.Search.dll", "pathtofile": null, "moduleaddress": "0x6aa50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,018", "eid": 1746, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x75df0000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1747, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1748, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1749, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1750, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1751, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,018", "eid": 1752, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1753, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1754, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1755, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1756, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1757, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1758, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1759, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1760, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\name", "content": "Microsoft Edge" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1761, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1762, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1763, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\dr", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1764, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1765, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1766, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\tttoken", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1767, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1768, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\(Default)", "content": "rrf@0.99" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1769, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1770, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\hint", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1771, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1772, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1773, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\iid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1774, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1775, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\brand", "content": "INBX" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1776, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\client", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1777, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ActivePingDayStartSec", "content": "1779926400" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1778, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\RollCallDayStartSec", "content": "1779926400" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1779, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallTime", "content": "1779981955" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1780, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastActivity", "content": "7087" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1781, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfLastRollCall", "content": "7087" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1782, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\DayOfInstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1783, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1784, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oobeinstall", "content": "13424455577847925" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,018", "eid": 1785, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\updatecount", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,018", "eid": 1786, "data": { "file": "C:\\Windows\\SysWOW64\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x74a60000" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:51,034", "eid": 1787, "data": { "file": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-29 10:44:51,034", "eid": 1788, "data": { "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" } }, { "event": "create", "object": "dir", "timestamp": "2026-05-29 10:44:51,034", "eid": 1789, "data": { "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" } }, { "event": "delete", "object": "file", "timestamp": "2026-05-29 10:44:51,034", "eid": 1790, "data": { "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:51,034", "eid": 1791, "data": { "file": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1792, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1793, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1794, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NormalizeLinkNetPidls", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1795, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:51,034", "eid": 1799, "data": { "file": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1800, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\\.exe", "content": "program" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type", "content": "application/x-msdownload" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\\UseLocalMachineSoftwareClassesWhenImpersonating", "content": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)", "content": "exefile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1807, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1809, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1810, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1811, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1812, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type", "content": "application/x-msdownload" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1813, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1814, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1815, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,034", "eid": 1818, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1819, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1820, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1821, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1822, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1823, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1824, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 10:44:51,049", "eid": 1825, "data": { "file": "C:\\Program Files (x86)\\desktop.ini" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1826, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1827, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1828, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1829, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1830, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1831, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1832, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1833, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1834, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1835, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1836, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1837, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1838, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1839, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1840, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1841, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1842, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1843, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1844, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1845, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1846, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1847, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1848, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1849, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1852, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1853, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1855, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1856, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1857, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,049", "eid": 1858, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1859, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1860, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\lastrun", "content": "13424525062565861" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1861, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InactivityBadgeApplied", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1862, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1863, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "content": "13424456007311642" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1864, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1865, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1866, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1867, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseen", "content": "13424456007311642" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1868, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1869, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\freseenversion", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1870, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ping_freshness", "content": "{23C79A83-20A9-4FB0-83FD-22AA3FAE0A71}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1873, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1875, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1876, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1877, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1878, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1879, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\name", "content": "Microsoft Edge WebView2 Runtime" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1880, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\dr", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1881, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1882, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1883, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\tttoken", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1884, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1885, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\(Default)", "content": "rrf@0.53" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1886, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1887, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\hint", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1888, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1889, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1890, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\iid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1891, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1892, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\brand", "content": "EUWV" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1893, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\client", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1894, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ActivePingDayStartSec", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1895, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\RollCallDayStartSec", "content": "1779926400" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1896, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\InstallTime", "content": "1779982264" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1897, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastActivity", "content": "18446744073709551615" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1898, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfLastRollCall", "content": "7087" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1899, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\DayOfInstall", "content": "7087" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1900, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\oobeinstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1901, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\updatecount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1902, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1903, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\ping_freshness", "content": "{13551C0C-5B21-4FE7-869F-3A0973E7DAF5}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1904, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1905, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1906, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Control Panel\\International\\LocaleName", "content": "en-AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1907, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1908, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1909, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": "1.3.233.3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1910, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1911, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1912, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\name", "content": "Microsoft Edge Update" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1913, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\dr", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1914, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1915, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1916, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\tttoken", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1917, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1918, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "content": "rrf@0.45" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1919, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1920, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1921, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1922, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1923, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1924, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1925, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "content": "INBX" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1926, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,065", "eid": 1927, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ActivePingDayStartSec", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1928, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\RollCallDayStartSec", "content": "1779926400" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1929, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime", "content": "1779981955" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1930, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastActivity", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1931, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfLastRollCall", "content": "7087" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1932, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1933, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oobeinstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1934, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\updatecount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1935, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1936, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\ping_freshness", "content": "{B870E696-85A1-478B-AC82-A079D930C77C}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1937, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\usagestats", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1938, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1939, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1940, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1941, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1942, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1943, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1944, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1945, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,081", "eid": 1946, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1947, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\InstallerProgress" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1948, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1949, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\eulaaccepted", "content": null } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1950, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\CurrentState" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1951, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallerProgress" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1952, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\CurrentState" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1953, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1954, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\oeminstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1955, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\eulaaccepted", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\oeminstall", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1962, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1963, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1964, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\CurrentState\\StateValue", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1965, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1966, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "content": "{4C572733-2FBA-4346-9601-F86DBA666EF2}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1967, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1968, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1969, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1970, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": "{FF7E44AB-182C-4237-80DB-F58260993716}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1971, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\old-uid", "content": "{FF7E44AB-182C-4237-80DB-F58260993716}" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1972, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1973, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\OemInstallTime", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1974, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1975, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": "{BEFBCB77-63F8-429E-8863-F0DC8214DEE6}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1977, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-create-time", "content": "1780051491" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1978, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations", "content": "1" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid-num-rotations", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1980, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1981, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\\2\\ServiceName", "content": "{4C572733-2FBA-4346-9601-F86DBA666EF2}" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1982, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1983, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\uid" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1984, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid\\ABshOnzU", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1985, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1986, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\uid", "content": "{BEFBCB77-63F8-429E-8863-F0DC8214DEE6}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,081", "eid": 1987, "data": { "file": "C:\\Windows\\System32\\ntdll.dll", "pathtofile": null, "moduleaddress": "0x777a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,081", "eid": 1988, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1989, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "3803" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,081", "eid": 1990, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,081", "eid": 1992, "data": { "file": "C:\\Windows\\System32\\wldp.dll", "pathtofile": null, "moduleaddress": "0x74a30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,081", "eid": 1993, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer", "content": "ASUS" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1996, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName", "content": "PRIME B450M-A II" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1998, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\packageContents", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 1999, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{A520A1A4-1780-4FF6-BD18-167343C5AF16}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2000, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2001, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": "%SystemDrive%\\ProgramData" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2002, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2003, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": "%SystemDrive%\\Users\\Public" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2004, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2005, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": "%SystemDrive%\\Users\\Default" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2006, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2007, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2008, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2009, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2011, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2012, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2014, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": "C:\\Program Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": "C:\\Program Files\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2018, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2020, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2021, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": "%USERPROFILE%\\AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2022, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2024, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2025, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2026, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2027, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,081", "eid": 2029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath", "content": "%systemroot%\\system32\\config\\systemprofile" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,096", "eid": 2030, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,096", "eid": 2031, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:51,096", "eid": 2032, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2033, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2034, "data": { "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\Geo\\Name", "content": "AU" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2036, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\LastECSETag", "content": "\"Z4YNAWPMOlHJbvgX3eb6sgxxvBAjTfZLbRpNgdduL+o=\"" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\lang", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\brand", "content": "INBX" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\client", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\iid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_labels", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\(Default)", "content": "rrf@0.45" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\hint", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime", "content": "1779981955" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\InstallTime", "content": "1779981955" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:51,096", "eid": 2051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\DayOfInstall", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:51,112", "eid": 2052, "data": { "file": "C:\\Windows\\SysWOW64\\msxml6.dll", "pathtofile": null, "moduleaddress": "0x6f0b0000" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,128", "eid": 2053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:51,128", "eid": 2054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\PersistedPings\\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\\PersistedPingString", "content": "0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime", "content": "\\x18\\xedv\\x16X\\xef\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,034", "eid": 2961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl", "content": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:53,253", "eid": 2962, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:53,253", "eid": 2963, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:53,253", "eid": 2964, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:53,253", "eid": 2965, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:44:53,253", "eid": 2966, "data": { "file": "C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2967, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\EdgeUpdate\\proxy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2968, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2969, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "content": "IEWPAD" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2970, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\EdgeUpdate\\proxy\\source", "content": "IEWPAD" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2971, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2972, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2973, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\experiment_control_labels", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2974, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2975, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\pv", "content": "1.3.233.3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\\opv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2977, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2978, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\pv", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\opv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2980, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2981, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\pv", "content": "148.0.3967.83" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2982, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\opv", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,253", "eid": 2983, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,253", "eid": 2984, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2985, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\usagestats", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2986, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientStateMedium\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2987, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\\usagestats", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2988, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EdgeUpdate\\UsageStats\\Daily" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2989, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2990, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\omaha_version", "content": "\\x03\\x00\\xe9\\x00\\x03\\x00\\x01\\x00" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2992, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Booleans\\is_system_install", "content": "\\x01\\x00\\x00\\x00" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2993, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main", "content": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_main", "content": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2996, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor", "content": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Counts\\goopdate_constructor", "content": "Q\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:44:53,253", "eid": 2998, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\UsageStats\\Daily\\Integers\\windows_major_version", "content": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 2999, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3000, "data": { "file": "api-ms-win-appmodel-runtime-l1-1-2", "pathtofile": null, "moduleaddress": "0x74950000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3001, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3002, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3003, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3004, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3005, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3006, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3007, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3008, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,268", "eid": 3009, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:44:53,268", "eid": 3010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:44:53,268", "eid": 3011, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,931", "eid": 3012, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,931", "eid": 3013, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,931", "eid": 3014, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3018, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "content": "{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3020, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3021, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,931", "eid": 3022, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,931", "eid": 3024, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3025, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3026, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "content": "\\x01\\x00\\x14\\x80\\x90\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00`\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3027, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "content": "Shield Provider User Session Agent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3030, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3031, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3032, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3033, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,947", "eid": 3034, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,947", "eid": 3036, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,947", "eid": 3037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,963", "eid": 3038, "data": { "file": "C:\\Windows\\System32\\SecurityHealthAgent.dll", "pathtofile": null, "moduleaddress": "0x7fff18110000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "content": "{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": "Windows Security Health Agent Proxy Stub Factory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": "Windows Security Health Agent Proxy Stub Factory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,963", "eid": 3054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,963", "eid": 3055, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,963", "eid": 3056, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,963", "eid": 3057, "data": { "file": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff4c1e0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3058, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3060, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "content": "C:\\Windows\\System32\\msxml6.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,978", "eid": 3069, "data": { "file": "C:\\Windows\\System32\\msxml6.dll", "pathtofile": null, "moduleaddress": "0x7fff52b60000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,978", "eid": 3070, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3073, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3074, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3075, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3076, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3077, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3078, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3079, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3080, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3082, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,978", "eid": 3083, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,994", "eid": 3084, "data": { "file": "C:\\Windows\\System32\\wpnapps.dll", "pathtofile": null, "moduleaddress": "0x7fff40fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:20,994", "eid": 3085, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3089, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3090, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3091, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3092, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3093, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3096, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:20,994", "eid": 3097, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3098, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3099, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": "Windows Push Notification Platform" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3101, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3102, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3103, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3104, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3105, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3106, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3107, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3108, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3109, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3110, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3111, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3112, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3113, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3114, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3115, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3116, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,010", "eid": 3119, "data": { "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff50870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,010", "eid": 3120, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,010", "eid": 3121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,025", "eid": 3122, "data": { "file": "C:\\Windows\\System32\\ShellCommonCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff3fd40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,025", "eid": 3123, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,025", "eid": 3124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,025", "eid": 3125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,041", "eid": 3126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,041", "eid": 3127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,041", "eid": 3128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,041", "eid": 3129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,056", "eid": 3130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3131, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3132, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3133, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3134, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3135, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3136, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3137, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3138, "data": { "file": "api-ms-win-appmodel-runtime-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff55510000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3139, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,056", "eid": 3140, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,072", "eid": 3141, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,072", "eid": 3142, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,072", "eid": 3143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:21,072", "eid": 3144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:21,072", "eid": 3145, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\WerSvcGroup", "content": "\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\EnableSvchostMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SCMConfig\\SvchostHeapReportingThresholdInKB", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Alias", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDll", "content": "%SystemRoot%\\System32\\WerSvc.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceManifest", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,416", "eid": 3153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceMain", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,431", "eid": 3154, "data": { "file": "C:\\Windows\\System32\\wersvc.dll", "pathtofile": null, "moduleaddress": "0x7fff171d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,431", "eid": 3155, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,431", "eid": 3156, "data": { "file": "WLDP.DLL", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,431", "eid": 3157, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,431", "eid": 3158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\LegacyCOMBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,431", "eid": 3159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ServiceTimeout", "content": "60000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3160, "data": { "file": "wer.dll", "pathtofile": null, "moduleaddress": "0x7fff55330000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3161, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3164, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3167, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3168, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3169, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3170, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3171, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3172, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3173, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3177, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3180, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3181, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3182, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3183, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3184, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3185, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3186, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3187, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3188, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3189, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3190, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3191, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3192, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3193, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3194, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3195, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3196, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3197, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3198, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3199, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3200, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3201, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3202, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3203, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3204, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3205, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3206, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3207, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3208, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3209, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3210, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3211, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3212, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3213, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3214, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3215, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3216, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3217, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3218, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3219, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3221, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3222, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3224, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3225, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3226, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3227, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3230, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3231, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3232, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3233, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3234, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3235, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3236, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3237, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3238, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3239, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3240, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3241, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3242, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3243, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3244, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3245, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3246, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3247, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3248, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3249, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3250, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3251, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,447", "eid": 3252, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3253, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3254, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3255, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,447", "eid": 3256, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3257, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3258, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3259, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3260, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3261, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3262, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3263, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3264, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3265, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3266, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3267, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3268, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3269, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3270, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3271, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3272, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3273, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3274, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3275, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3276, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3277, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3278, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3279, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3280, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3281, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3282, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3283, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3284, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3285, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3286, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3287, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3288, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3289, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3290, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3291, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3292, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3293, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3294, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3295, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3296, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3297, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3298, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3299, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3300, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3301, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3302, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3303, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3304, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3305, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,463", "eid": 3306, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3307, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3308, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,463", "eid": 3309, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3310, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3311, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3312, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3313, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3314, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3315, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3316, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3317, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3318, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3319, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3320, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3321, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3322, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3323, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3324, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3325, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3326, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3327, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3328, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3329, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3330, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3331, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3338, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3340, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3341, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3344, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3345, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3346, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3347, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3348, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3349, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3350, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3351, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3352, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3353, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3354, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3355, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3356, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3357, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3358, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3359, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3360, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3361, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3373, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3374, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3375, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3376, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3377, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3378, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3379, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3387, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3388, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3391, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3392, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3394, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3395, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3396, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3397, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3398, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3399, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3400, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3401, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3402, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3403, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,478", "eid": 3404, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3405, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,478", "eid": 3406, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3407, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3408, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3409, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3410, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3411, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3412, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3413, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3414, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3415, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3416, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3417, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3418, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3419, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3420, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3422, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3423, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3424, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3425, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3426, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3427, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3428, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3429, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3430, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3431, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3432, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3433, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3434, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3435, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3436, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3437, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3440, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3441, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3442, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3447, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3448, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3454, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3455, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3456, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3457, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,494", "eid": 3458, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,494", "eid": 3461, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,510", "eid": 3462, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,510", "eid": 3463, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,510", "eid": 3464, "data": { "file": "C:\\Windows\\system32\\WerFault.exe -pss -s 688 -p 8756 -ip 8756" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,603", "eid": 3465, "data": { "file": "api-ms-win-core-file-l1-2-1.dll", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,603", "eid": 3466, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoReflection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3475, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3476, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3477, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3478, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3479, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3480, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3481, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3482, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3483, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3484, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3485, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3488, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3489, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3490, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,603", "eid": 3491, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3492, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3493, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3494, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3495, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3496, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3497, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3498, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3499, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3500, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3501, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3502, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3503, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3504, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3505, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3506, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3507, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3508, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3509, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3510, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3511, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3512, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3517, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3521, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3522, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3524, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3525, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3527, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3528, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3530, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3531, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3532, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3533, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3536, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3540, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3541, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3543, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3544, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3545, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3547, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3548, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3550, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3551, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3552, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3553, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3554, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3555, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3556, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3557, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3559, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3560, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3561, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3562, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3566, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3567, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3573, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3579, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3580, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3581, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3582, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3583, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3585, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3586, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,619", "eid": 3587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3588, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,619", "eid": 3589, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3590, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3591, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3593, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3594, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3595, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3596, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3597, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3598, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3608, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3609, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3610, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3611, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3612, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3613, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3614, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3615, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3616, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3617, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3618, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3619, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3620, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3621, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3622, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3623, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3624, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3625, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3626, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3627, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3628, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3629, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3630, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3631, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3632, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3633, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3634, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3635, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3636, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3637, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3639, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3641, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3642, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3643, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3644, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3645, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3646, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3647, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3648, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3649, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3650, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3651, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3652, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3653, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3654, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3656, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3660, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3661, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3663, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3665, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3668, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3672, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3673, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,635", "eid": 3674, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3675, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,635", "eid": 3676, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3677, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3678, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3679, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3680, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3681, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3682, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3685, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3686, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3687, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3688, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3689, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3690, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3691, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3692, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3693, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3694, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3695, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3696, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3697, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3698, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3699, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3700, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3701, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3702, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3703, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3704, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3705, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3706, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3707, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3708, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3709, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3710, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3711, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3712, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3713, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3714, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3715, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3716, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3717, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3718, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3719, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3720, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3721, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3725, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3727, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3728, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3729, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3730, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3731, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3732, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3733, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3734, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3736, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3737, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3738, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,650", "eid": 3739, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3740, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3741, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3744, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3745, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3746, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3747, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3748, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3749, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3750, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3751, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3752, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3753, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,650", "eid": 3754, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3755, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,666", "eid": 3756, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,666", "eid": 3757, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,666", "eid": 3758, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,666", "eid": 3759, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,666", "eid": 3760, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3761, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3762, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3763, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3764, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3765, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData", "content": "%SystemDrive%\\ProgramData" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3766, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,666", "eid": 3767, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public", "content": "%SystemDrive%\\Users\\Public" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3768, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3769, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Default", "content": "%SystemDrive%\\Users\\Default" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3770, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3771, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "content": "C:\\Program Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3772, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3773, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "content": "C:\\Program Files\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3774, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3775, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir (x86)", "content": "C:\\Program Files (x86)" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3776, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3777, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir (x86)", "content": "C:\\Program Files (x86)\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3778, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3779, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramW6432Dir", "content": "C:\\Program Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3780, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3781, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CommonW6432Dir", "content": "C:\\Program Files\\Common Files" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3782, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3783, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3784, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3785, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": "%USERPROFILE%\\AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3786, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3787, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3788, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3789, "data": { "regkey": "HKEY_USERS\\S-1-5-21-3968686040-3210279463-847977608-1001\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3790, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,681", "eid": 3791, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 10:45:22,681", "eid": 3792, "data": { "file": "C:\\Windows\\system32\\WerFault.exe -u -p 8756 -s 284" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3793, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3794, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3795, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3799, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3800, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3807, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3809, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3810, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3811, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3812, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3813, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3814, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3815, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3818, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3819, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3820, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3821, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3822, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3823, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3824, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3825, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3826, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3827, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3828, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3829, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3830, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3831, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3832, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3833, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3834, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3835, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3836, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3837, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3838, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3839, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3840, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3841, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3842, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3843, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3844, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3845, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3846, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3847, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3848, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3849, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3852, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3853, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3855, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3856, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3857, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3858, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3859, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3860, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3861, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3862, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3863, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3864, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3865, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3866, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3867, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3868, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3869, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3870, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3873, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3875, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3876, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3877, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3878, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3879, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3880, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3881, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3882, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,869", "eid": 3883, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3884, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,869", "eid": 3885, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3886, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3887, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3888, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3889, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3890, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3891, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3892, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3893, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3894, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3895, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3896, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3897, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3898, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3899, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3900, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3901, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3902, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3903, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3904, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3905, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3906, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3907, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3908, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3909, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3910, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3911, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3912, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3913, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3914, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3915, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3916, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3917, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3918, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3919, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3920, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3921, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3922, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3923, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3924, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3925, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3926, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3927, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3928, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3929, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3930, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3931, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3932, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3933, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3934, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3935, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3936, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,885", "eid": 3937, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3938, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3939, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,885", "eid": 3940, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,900", "eid": 3941, "data": { "file": "C:\\Windows\\System32\\ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,900", "eid": 3942, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3943, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3944, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3945, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3946, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3947, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3948, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3949, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3950, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3951, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3952, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3953, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3954, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3955, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3956, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3957, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3958, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3959, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3960, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3961, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3962, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3963, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3964, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3965, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3966, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3967, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3968, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3969, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3970, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3971, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3972, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3973, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3974, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3975, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3976, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3977, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3978, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3979, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3980, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3981, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3982, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3983, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3984, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3985, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3986, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3987, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3988, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3989, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 10:45:22,900", "eid": 3990, "data": { "file": "C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\NewUserDefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3992, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3993, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3996, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3998, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 3999, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4000, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4001, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4002, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4003, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4004, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4005, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4006, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4007, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4008, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4009, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4011, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4012, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4014, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4018, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4020, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4021, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4022, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4024, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassPowerThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4025, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassNetworkCostThrottling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4026, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueNoPesterInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4027, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\AutoApproveOSDumps", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinFreeDiskSpace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LiveReportFlushInterval", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4030, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4031, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceHeapDump", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4032, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceMetadata", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4033, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Source", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4034, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\User", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\StorePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4036, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceEtw", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\UploadOnFreeNetworksOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveSeparate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CabArchiveCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalCompression", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableWerUpload", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableEnterpriseAuthProxy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ArchiveFolderCountLimit", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueueSizeMaxPercentFreeDisk", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MinQueueSize", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxRetriesForSasRenewal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\NoHeapDumpOnQueue", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DeferCabUpload", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4050, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4051, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4053, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4054, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4055, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4056, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4057, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4058, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4060, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4069, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4070, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4073, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4074, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4075, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4076, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4077, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4078, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4079, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4080, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,931", "eid": 4081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4082, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,931", "eid": 4083, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4084, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4085, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4089, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4090, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4091, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4092, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4093, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4096, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4097, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4098, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4099, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4101, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4102, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4103, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4104, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4105, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4106, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4107, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4108, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4109, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4110, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4111, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4112, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4113, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4114, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4115, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4116, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior", "content": "73777" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4119, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect", "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4122, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect", "content": "AllowTelemetry_PolicyManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4123, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4131, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4132, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4133, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4134, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:22,947", "eid": 4135, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4137, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MSFTInternal", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:22,947", "eid": 4138, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\IsTest", "content": null } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4139, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\TermReason" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4140, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4141, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424\\CreationTime", "content": "e\\x84\\\\xaf\\x05\\xef\\xdc\\x01" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4142, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\CreationTime", "content": "\\xcb\\x18\\:X\\xef\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "content": "HAM" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\5116\\Terminator", "content": "HAM" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\CreationTime", "content": "\\x947Y\\x18X\\xef\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4154, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "content": "HAM" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4155, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4156, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4157, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\7928\\Terminator", "content": "HAM" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288\\CreationTime", "content": "\\xb9\\xc0v\\xaf\\x05\\xef\\xdc\\x01" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4161, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116\\CreationTime", "content": "j\r\\x1a\\x9c\\x05\\xef\\xdc\\x01" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\CreationTime", "content": "\\xb7Pp\\x1cX\\xef\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4164, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "content": "HAM" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4167, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4168, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4169, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9148\\Terminator", "content": "HAM" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4170, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4171, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\CreationTime", "content": "\\xca\\xddD\\x16X\\xef\\xdc\\x01" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4172, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4173, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "content": "HAM" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Reason", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4177, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9184\\Terminator", "content": "HAM" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204\\CreationTime", "content": "\\x9f\\xca\\xf8\\xbf\\x05\\xef\\xdc\\x01" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4180, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\424" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4181, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\8288" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4182, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9116" } }, { "event": "delete", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4183, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\TermReason\\9204" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,978", "eid": 4184, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WerSvc\\Parameters\\ServiceDllUnloadOnStop", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4185, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4186, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4187, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4188, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4189, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4190, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4191, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4192, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4193, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,994", "eid": 4194, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:47:22,994", "eid": 4195, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:47:22,994", "eid": 4196, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,556", "eid": 4197, "data": { "file": "C:\\Windows\\System32\\flightsettings.dll", "pathtofile": null, "moduleaddress": "0x7fff40a10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,556", "eid": 4198, "data": { "file": "WLDP.DLL", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,556", "eid": 4199, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,556", "eid": 4200, "data": { "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff50870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,572", "eid": 4201, "data": { "file": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff48780000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,572", "eid": 4202, "data": { "file": "C:\\Windows\\System32\\wosc.dll", "pathtofile": null, "moduleaddress": "0x7fff188a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,572", "eid": 4203, "data": { "file": "C:\\Windows\\System32\\FlightSettings.dll", "pathtofile": null, "moduleaddress": "0x7fff40a10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,572", "eid": 4204, "data": { "file": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll", "pathtofile": null, "moduleaddress": "0x7fff42490000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,572", "eid": 4205, "data": { "file": "C:\\Windows\\System32\\npmproxy.dll", "pathtofile": null, "moduleaddress": "0x7fff4f560000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,588", "eid": 4206, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x7fff52dc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,588", "eid": 4207, "data": { "file": "C:\\Windows\\System32\\UpdatePolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,588", "eid": 4208, "data": { "file": "C:\\Windows\\System32\\Windows.Web.dll", "pathtofile": null, "moduleaddress": "0x7fff47980000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,603", "eid": 4209, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,603", "eid": 4210, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4211, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4212, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4213, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4214, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4215, "data": { "file": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll", "pathtofile": null, "moduleaddress": "0x7fff3e220000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4216, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4217, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,619", "eid": 4218, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,635", "eid": 4219, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,635", "eid": 4220, "data": { "file": "C:\\Windows\\System32\\fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,635", "eid": 4221, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,650", "eid": 4222, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,650", "eid": 4223, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4224, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4225, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4226, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4227, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4228, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,666", "eid": 4229, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4230, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4231, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff17420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4232, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4233, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4234, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4235, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4236, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4237, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4238, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4239, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,681", "eid": 4240, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,697", "eid": 4241, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,713", "eid": 4242, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,713", "eid": 4243, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,713", "eid": 4244, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,713", "eid": 4245, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4246, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4247, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4248, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4249, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4250, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,728", "eid": 4251, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,744", "eid": 4252, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,744", "eid": 4253, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4254, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4255, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4256, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4257, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4258, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,760", "eid": 4259, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4260, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4261, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff17420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4262, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4263, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4264, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4265, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4266, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4267, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4268, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4269, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,775", "eid": 4270, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,791", "eid": 4271, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4272, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4273, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4274, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4275, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4276, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4277, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4278, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4279, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4280, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,806", "eid": 4281, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4282, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4283, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4284, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4285, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4286, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4287, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4288, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,838", "eid": 4289, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4290, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4291, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff17420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4292, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4293, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4294, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4295, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4296, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4297, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4298, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4299, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4300, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,853", "eid": 4301, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4302, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4303, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4304, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4305, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4306, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4307, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4308, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4309, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4310, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,885", "eid": 4311, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4312, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4313, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4314, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4315, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4316, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4317, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,916", "eid": 4318, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4319, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4320, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4321, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff17420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4322, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4323, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4324, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4325, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4326, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4327, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4328, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4329, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4330, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,931", "eid": 4331, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4332, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4333, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4334, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4335, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4336, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4337, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4338, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4339, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4340, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,963", "eid": 4341, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,978", "eid": 4342, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,978", "eid": 4343, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4344, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4345, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4346, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4347, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4348, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:43,994", "eid": 4349, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4350, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4351, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff17420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4352, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4353, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4354, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4355, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4356, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4357, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4358, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4359, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4360, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,010", "eid": 4361, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,072", "eid": 4362, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4363, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4364, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4365, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4366, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4367, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4368, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4369, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4370, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,088", "eid": 4371, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,103", "eid": 4372, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,103", "eid": 4373, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,103", "eid": 4374, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,103", "eid": 4375, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,103", "eid": 4376, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4377, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4378, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4379, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4380, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4381, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff12fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4382, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4383, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4384, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4385, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4386, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4387, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4388, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4389, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,119", "eid": 4390, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,135", "eid": 4391, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4392, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4393, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4394, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4395, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4396, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4397, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4398, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4399, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4400, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,150", "eid": 4401, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,166", "eid": 4402, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4403, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4404, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4405, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4406, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4407, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4408, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,181", "eid": 4409, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4410, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4411, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff12fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4412, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4413, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4414, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4415, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4416, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4417, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4418, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4419, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4420, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,197", "eid": 4421, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,213", "eid": 4422, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4423, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4424, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4425, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4426, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4427, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4428, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4429, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4430, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,228", "eid": 4431, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,244", "eid": 4432, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4433, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4434, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4435, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4436, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4437, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4438, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,260", "eid": 4439, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4440, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4441, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff12fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4442, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4443, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4444, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4445, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4446, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4447, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4448, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4449, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4450, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,275", "eid": 4451, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,291", "eid": 4452, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4453, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4454, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4455, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4456, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4457, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4458, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4459, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4460, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,306", "eid": 4461, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,322", "eid": 4462, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,322", "eid": 4463, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4464, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4465, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4466, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4467, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4468, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4469, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4470, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4471, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff12fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4472, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,338", "eid": 4473, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4474, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4475, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4476, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4477, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4478, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4479, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4480, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,353", "eid": 4481, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,369", "eid": 4482, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4483, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4484, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4485, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4486, "data": { "file": "AEPIC.dll", "pathtofile": null, "moduleaddress": "0x7fff45630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4487, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4488, "data": { "file": "policymanager.dll", "pathtofile": null, "moduleaddress": "0x7fff522d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4489, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4490, "data": { "file": "fcon.dll", "pathtofile": null, "moduleaddress": "0x7fff42c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,385", "eid": 4491, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,400", "eid": 4492, "data": { "file": "updatepolicy.dll", "pathtofile": null, "moduleaddress": "0x7fff3ee40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,400", "eid": 4493, "data": { "file": "utcutil.dll", "pathtofile": null, "moduleaddress": "0x7fff1c380000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,400", "eid": 4494, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,400", "eid": 4495, "data": { "file": "dcntel.dll", "pathtofile": null, "moduleaddress": "0x7fff19b10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,400", "eid": 4496, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4497, "data": { "file": "Tbs.dll", "pathtofile": null, "moduleaddress": "0x7fff4fa10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4498, "data": { "file": "wldp.dll", "pathtofile": null, "moduleaddress": "0x7fff56fa0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4499, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4500, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4501, "data": { "file": "appraiser.dll", "pathtofile": null, "moduleaddress": "0x7fff12fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4502, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4503, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4504, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4505, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4506, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4507, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4508, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4509, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,416", "eid": 4510, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:44,431", "eid": 4511, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7fff56630000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4512, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4517, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4521, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4522, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4524, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4525, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4527, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4528, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4530, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4531, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4532, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4533, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4536, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4540, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4541, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4543, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4544, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4545, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4547, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4548, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,947", "eid": 4549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "content": "combase.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4550, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,947", "eid": 4551, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,963", "eid": 4552, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,963", "eid": 4553, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7fff54fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,963", "eid": 4554, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4555, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4556, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4557, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4559, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4560, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4561, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4562, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4566, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4567, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "content": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4573, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4579, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,963", "eid": 4580, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4581, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4582, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4583, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4585, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4586, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4588, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4589, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4590, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4591, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,978", "eid": 4593, "data": { "file": "C:\\Windows\\System32\\thumbcache.dll", "pathtofile": null, "moduleaddress": "0x7fff432b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,978", "eid": 4594, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,978", "eid": 4595, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4596, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "content": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4597, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4598, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4608, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4609, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4610, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 10:45:48,978", "eid": 4611, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,978", "eid": 4612, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7fff52860000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:48,978", "eid": 4613, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:54,041", "eid": 4614, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:54,041", "eid": 4615, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:54,041", "eid": 4616, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 10:45:54,041", "eid": 4617, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [], "com_activations": [] } }, "debug": { "log": "2026-05-28 20:55:31,182 [root] INFO: Date set to: 20260529T06:44:12, timeout set to: 200\n2026-05-29 06:44:12,055 [root] DEBUG: Starting analyzer from: C:\\lpw_albt\n2026-05-29 06:44:12,057 [root] DEBUG: Storing results at: C:\\gZRInK\n2026-05-29 06:44:12,058 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\AMUWJCJPH\n2026-05-29 06:44:12,058 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-29 06:44:12,058 [root] INFO: analysis running as an admin\n2026-05-29 06:44:12,059 [root] INFO: analysis package specified: \"edge\"\n2026-05-29 06:44:12,059 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-29 06:44:12,065 [root] DEBUG: imported analysis package \"edge\"\n2026-05-29 06:44:12,066 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-29 06:44:12,066 [root] DEBUG: New location of moved file: https://badoomovies.com/download/BadooMovies.exe\n2026-05-29 06:44:12,070 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-29 06:44:12,072 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-29 06:44:12,072 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-29 06:44:12,074 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-29 06:44:12,133 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-29 06:44:12,201 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-29 06:44:12,216 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-29 06:44:12,225 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-29 06:44:12,231 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-29 06:44:12,232 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-29 06:44:12,233 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-29 06:44:12,242 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-29 06:44:12,243 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-29 06:44:12,244 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-29 06:44:12,245 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-29 06:44:12,245 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-29 06:44:12,246 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-29 06:44:12,246 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-29 06:44:12,246 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-29 06:44:12,247 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-29 06:44:12,247 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-29 06:44:12,247 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-29 06:44:12,247 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-29 06:44:12,248 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-29 06:44:12,248 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-29 06:44:12,248 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-29 06:44:12,248 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-29 06:44:12,261 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 1028)\n2026-05-29 06:44:12,261 [modules.auxiliary.disguise] INFO: Disguising GUID to 1fe1aae4-9186-4225-a287-b753d9a30a59\n2026-05-29 06:44:12,262 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-29 06:44:12,262 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-29 06:44:12,262 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-29 06:44:12,262 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-29 06:44:12,263 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-29 06:44:12,263 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-29 06:44:12,263 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-29 06:44:12,264 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-29 06:44:12,264 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-29 06:44:12,264 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-29 06:44:12,264 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-29 06:44:12,264 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-29 06:44:12,265 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-29 06:44:12,265 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-29 06:44:12,265 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-29 06:44:12,265 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-29 06:44:12,267 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-29 06:44:12,267 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-29 06:44:12,267 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-29 06:44:12,358 [lib.api.process] INFO: Monitor config for process 4484: C:\\lpw_albt\\dll\\4484.ini\n2026-05-29 06:44:12,359 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:12,362 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:12,412 [root] DEBUG: Loader: Injecting process 4484 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:12,584 [root] DEBUG: 4484: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:12,586 [root] DEBUG: 4484: Disabling sleep skipping.\n2026-05-29 06:44:12,588 [root] DEBUG: 4484: Interactive desktop enabled.\n2026-05-29 06:44:12,589 [root] DEBUG: 4484: Dropped file limit defaulting to 100.\n2026-05-29 06:44:12,591 [root] DEBUG: 4484: Interactive desktop - injecting Explorer Shell\n2026-05-29 06:44:12,612 [root] DEBUG: 4484: YaraInit: Compiled 44 rule files\n2026-05-29 06:44:12,615 [root] DEBUG: 4484: YaraInit: Compiled rules saved to file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:12,666 [root] DEBUG: 4484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:44:12,668 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316\n2026-05-29 06:44:12,723 [root] DEBUG: 4484: Monitor initialised: 64-bit capemon loaded in process 4484 at 0x00007FFF18240000, thread 1276, image base 0x00007FF79BC10000, stack from 0x0000000009051000-0x0000000009060000\n2026-05-29 06:44:12,724 [root] DEBUG: 4484: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-29 06:44:12,740 [root] DEBUG: 4484: Hooked 69 out of 69 functions\n2026-05-29 06:44:12,773 [root] DEBUG: 4484: Syscall hook installed, syscall logging level 1\n2026-05-29 06:44:12,781 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-29 06:44:12,782 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:12,783 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:13,366 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00007FF79BC10000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF79BD27BE7, thread 4696).\n2026-05-29 06:44:13,367 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316\n2026-05-29 06:44:13,401 [root] DEBUG: 4484: ProcessImageBase: Main module image at 0x00007FF79BC10000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:44:19,933 [root] INFO: Restarting WMI Service\n2026-05-29 06:44:19,952 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-29 06:44:19,953 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-29 06:44:19,953 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-29 06:44:19,954 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"https://badoomovies.com/download/BadooMovies.exe\"\" with pid 4104\n2026-05-29 06:44:19,955 [lib.api.process] INFO: Monitor config for process 4104: C:\\lpw_albt\\dll\\4104.ini\n2026-05-29 06:44:19,957 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:19,958 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:19,965 [root] DEBUG: Loader: Injecting process 4104 (thread 4828) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:19,965 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:19,966 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:19,967 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:21,971 [lib.api.process] INFO: Successfully resumed process with pid 4104\n2026-05-29 06:44:22,017 [root] DEBUG: 4104: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:22,019 [root] DEBUG: 4104: Disabling sleep skipping.\n2026-05-29 06:44:22,019 [root] DEBUG: 4104: Interactive desktop enabled.\n2026-05-29 06:44:22,020 [root] DEBUG: 4104: Dropped file limit defaulting to 100.\n2026-05-29 06:44:22,027 [root] DEBUG: 4104: Edge-specific hook-set enabled.\n2026-05-29 06:44:22,030 [root] DEBUG: 4104: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:22,041 [root] DEBUG: 4104: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:44:22,041 [root] DEBUG: 4104: Monitor initialised: 64-bit capemon loaded in process 4104 at 0x00007FFF18240000, thread 4828, image base 0x00007FF7F5380000, stack from 0x000000F49FFF4000-0x000000F4A0000000\n2026-05-29 06:44:22,041 [root] DEBUG: 4104: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"\n2026-05-29 06:44:22,052 [root] DEBUG: 4104: Hooked 2 out of 2 functions\n2026-05-29 06:44:22,087 [root] DEBUG: 4104: Syscall hook installed, syscall logging level 1\n2026-05-29 06:44:22,093 [root] DEBUG: 4104: RestoreHeaders: Restored original import table.\n2026-05-29 06:44:22,094 [root] INFO: Loaded monitor into process with pid 4104\n2026-05-29 06:44:22,097 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-29 06:44:22,102 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43500000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-29 06:44:22,103 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:44:22,104 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-29 06:44:22,104 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-29 06:44:22,105 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-29 06:44:22,106 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:44:22,277 [root] DEBUG: 4104: DLL loaded at 0x00007FFF453C0000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-29 06:44:22,278 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFE540000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-29 06:44:22,281 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45010000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-29 06:44:22,284 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-29 06:44:22,289 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 06:44:22,290 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1204: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,290 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 06:44:22,290 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1204\n2026-05-29 06:44:22,291 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3E220000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-29 06:44:22,291 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1204\n2026-05-29 06:44:22,292 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:44:22,292 [root] DEBUG: 4104: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:44:22,296 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57520000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-29 06:44:22,297 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55EC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-29 06:44:22,297 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56750000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-29 06:44:22,298 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-29 06:44:22,299 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:44:22,301 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16A40000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-29 06:44:22,302 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:44:22,303 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-29 06:44:22,303 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57010000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF15300000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-29 06:44:22,305 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3F6A0000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-29 06:44:22,305 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-29 06:44:22,306 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-29 06:44:22,308 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52F20000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-29 06:44:22,311 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57560000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-29 06:44:22,319 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CFA0000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-29 06:44:22,321 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58380000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-29 06:44:22,321 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4D3D0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-29 06:44:22,322 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:44:22,323 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-29 06:44:22,324 [root] DEBUG: 4104: DLL loaded at 0x00007FFF49A90000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-29 06:44:22,327 [root] DEBUG: 4104: DLL loaded at 0x00007FFF44D50000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-29 06:44:22,328 [root] DEBUG: 4104: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-29 06:44:22,328 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57350000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-29 06:44:22,330 [root] DEBUG: 4104: DLL loaded at 0x00007FFF569F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-29 06:44:22,330 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52960000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-29 06:44:22,332 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58B20000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-29 06:44:22,333 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-29 06:44:22,334 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515C0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-29 06:44:22,334 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4B070000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-29 06:44:22,335 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515A0000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-29 06:44:22,336 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52860000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-29 06:44:22,337 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56A40000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-29 06:44:22,339 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CBF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54850000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54170000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-29 06:44:22,343 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4B680000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-29 06:44:22,345 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CD70000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-29 06:44:22,348 [root] DEBUG: 4104: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-29 06:44:22,349 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CD40000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-29 06:44:22,350 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45580000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-29 06:44:22,353 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52420000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-29 06:44:22,353 [root] DEBUG: 4104: DLL loaded at 0x00007FFF47AB0000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF51A60000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4AF10000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4BFB0000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-29 06:44:22,358 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4D6A0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-29 06:44:22,359 [root] DEBUG: 4104: DLL loaded at 0x00007FFF47980000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-29 06:44:22,360 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52B00000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-29 06:44:22,368 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515E0000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-29 06:44:22,369 [root] DEBUG: 4104: DLL loaded at 0x00007FFF51600000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-29 06:44:22,370 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57360000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-29 06:44:22,373 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52560000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:44:22,385 [root] DEBUG: 4104: DLL loaded at 0x00007FFF15A80000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-29 06:44:22,389 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 2168: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,390 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 2168\n2026-05-29 06:44:22,391 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 2168\n2026-05-29 06:44:22,393 [root] DEBUG: 4104: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 8576).\n2026-05-29 06:44:22,394 [root] DEBUG: 4104: DLL loaded at 0x00007FFF48330000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-29 06:44:22,396 [root] DEBUG: 4104: DLL loaded at 0x00007FFF49D10000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-29 06:44:22,398 [root] DEBUG: 4104: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:44:22,400 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1332: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,400 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1332\n2026-05-29 06:44:22,401 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1332\n2026-05-29 06:44:22,405 [root] DEBUG: 4104: DLL loaded at 0x00007FFF573C0000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-29 06:44:22,411 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-29 06:44:22,412 [root] DEBUG: 4104: DLL loaded at 0x00007FFF409A0000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-29 06:44:22,421 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 4760: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,421 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43590000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-29 06:44:22,423 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4760\n2026-05-29 06:44:22,426 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4760\n2026-05-29 06:44:22,470 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55EF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-29 06:44:22,471 [root] DEBUG: 4104: DLL loaded at 0x00007FFF53070000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-29 06:44:22,471 [root] DEBUG: 4104: DLL loaded at 0x00007FFF538A0000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-29 06:44:22,472 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43630000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-29 06:44:22,498 [root] DEBUG: 4104: DLL loaded at 0x00007FFF18950000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-29 06:44:22,514 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55220000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-29 06:44:22,521 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43990000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-29 06:44:22,522 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 4108: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,523 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 5820: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:22,523 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4108\n2026-05-29 06:44:22,523 [root] DEBUG: 4104: DLL loaded at 0x00007FFF488B0000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-29 06:44:22,524 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 5820\n2026-05-29 06:44:22,524 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4108\n2026-05-29 06:44:22,525 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 5820\n2026-05-29 06:44:22,598 [root] DEBUG: 4104: DLL loaded at 0x00007FFF456D0000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-29 06:44:22,603 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3F8A0000: C:\\Windows\\SYSTEM32\\VCRUNTIME140 (0x1e000 bytes).\n2026-05-29 06:44:22,604 [root] DEBUG: 4104: DLL loaded at 0x00007FFF42BF0000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions (0x17000 bytes).\n2026-05-29 06:44:22,606 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16390000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-29 06:44:22,617 [root] DEBUG: 4104: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-29 06:44:22,620 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3E730000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-29 06:44:22,627 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16350000: C:\\Windows\\System32\\aadWamExtension (0x36000 bytes).\n2026-05-29 06:44:22,635 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57130000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-29 06:44:22,637 [root] DEBUG: 4104: DLL loaded at 0x00007FFF162C0000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-29 06:44:22,639 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-29 06:44:22,641 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56630000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-29 06:44:23,883 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3FD40000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-29 06:44:24,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:44:24,306 [root] DEBUG: 4104: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:44:27,545 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\SETUPAPI (0x46e000 bytes).\n2026-05-29 06:44:27,551 [root] DEBUG: 4104: DLL loaded at 0x00007FFF572F0000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-29 06:44:27,556 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9328: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:27,558 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54B30000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-29 06:44:27,562 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54B30000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-29 06:44:27,566 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57AA0000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-29 06:44:27,574 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9344: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:27,582 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9328\n2026-05-29 06:44:27,588 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9344\n2026-05-29 06:44:27,590 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9344\n2026-05-29 06:44:27,653 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFB560000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient (0x3ed000 bytes).\n2026-05-29 06:44:27,865 [root] DEBUG: 4104: DLL loaded at 0x00007FFF164C0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg (0x467000 bytes).\n2026-05-29 06:44:27,866 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F560000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-29 06:44:27,903 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFAF00000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds (0x33f000 bytes).\n2026-05-29 06:44:28,069 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56250000: C:\\Windows\\System32\\FirewallAPI (0x96000 bytes).\n2026-05-29 06:44:28,070 [root] DEBUG: 4104: DLL loaded at 0x00007FFF561E0000: C:\\Windows\\System32\\fwbase (0x36000 bytes).\n2026-05-29 06:44:28,077 [root] DEBUG: 4104: DLL loaded at 0x00007FFF12EB0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration (0x78000 bytes).\n2026-05-29 06:44:28,113 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-29 06:44:28,114 [root] DEBUG: 4104: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-29 06:44:28,115 [root] DEBUG: 4104: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-29 06:44:28,681 [root] DEBUG: 4104: DLL loaded at 0x00007FFF150C0000: C:\\Windows\\system32\\TenantRestrictionsPlugin (0x1b000 bytes).\n2026-05-29 06:44:28,719 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9528: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF6C7670000\n2026-05-29 06:44:28,721 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9528\n2026-05-29 06:44:28,722 [lib.api.process] INFO: Monitor config for process 9528: C:\\lpw_albt\\dll\\9528.ini\n2026-05-29 06:44:28,725 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:30,107 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-29 06:44:30,107 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-29 06:44:30,112 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:30,116 [root] DEBUG: Loader: Injecting process 9528 (thread 9532) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,117 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:30,117 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,120 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:30,139 [root] DEBUG: 4104: DLL loaded at 0x00007FFF501A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-29 06:44:30,140 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CBD0000: C:\\Windows\\SYSTEM32\\windows.staterepositorycore (0x11000 bytes).\n2026-05-29 06:44:30,141 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9656: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF6C7670000\n2026-05-29 06:44:30,142 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9656\n2026-05-29 06:44:30,142 [lib.api.process] INFO: Monitor config for process 9656: C:\\lpw_albt\\dll\\9656.ini\n2026-05-29 06:44:30,143 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:30,231 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-29 06:44:30,231 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-29 06:44:30,232 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-29 06:44:30,232 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-29 06:44:30,235 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:30,241 [root] DEBUG: Loader: Injecting process 9656 (thread 9660) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,241 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:30,242 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,243 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:30,247 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9656\n2026-05-29 06:44:30,247 [lib.api.process] INFO: Monitor config for process 9656: C:\\lpw_albt\\dll\\9656.ini\n2026-05-29 06:44:30,248 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:30,325 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-29 06:44:30,325 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-29 06:44:30,326 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F950000: C:\\Windows\\system32\\wlanapi (0x74000 bytes).\n2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-29 06:44:30,328 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:30,332 [root] DEBUG: Loader: Injecting process 9656 (thread 9660) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,334 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:30,334 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:30,337 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:30,351 [root] DEBUG: 9656: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:30,351 [root] DEBUG: 9656: Interactive desktop enabled.\n2026-05-29 06:44:30,352 [root] DEBUG: 9656: Dropped file limit defaulting to 100.\n2026-05-29 06:44:30,362 [root] DEBUG: 9656: Disabling sleep skipping.\n2026-05-29 06:44:30,364 [root] DEBUG: 9656: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:30,376 [root] DEBUG: 9656: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:44:30,377 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,406 [root] DEBUG: 9656: Monitor initialised: 64-bit capemon loaded in process 9656 at 0x00007FFF18240000, thread 9660, image base 0x00007FF6C7670000, stack from 0x000000FC372F4000-0x000000FC37300000\n2026-05-29 06:44:30,407 [root] DEBUG: 9656: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,1199331602286409\n2026-05-29 06:44:30,407 [root] DEBUG: 9656: add_all_dlls_to_dll_ranges: skipping C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll\n2026-05-29 06:44:30,419 [root] DEBUG: 9656: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-29 06:44:30,445 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-29 06:44:30,446 [root] DEBUG: 9656: set_hooks: Unable to hook LockResource\n2026-05-29 06:44:30,451 [root] DEBUG: 9656: Hooked 627 out of 628 functions\n2026-05-29 06:44:30,467 [root] DEBUG: 9656: Syscall hook installed, syscall logging level 1\n2026-05-29 06:44:30,473 [root] DEBUG: 9656: RestoreHeaders: Restored original import table.\n2026-05-29 06:44:30,474 [root] INFO: Loaded monitor into process with pid 9656\n2026-05-29 06:44:30,475 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,549 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,578 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,584 [root] DEBUG: 4104: DLL loaded at 0x00007FFF457F0000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-29 06:44:30,586 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F740000: C:\\Windows\\System32\\AppXDeploymentClient (0x102000 bytes).\n2026-05-29 06:44:30,608 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,635 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,659 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,688 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994\n2026-05-29 06:44:30,691 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:44:30,693 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57010000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-29 06:44:30,694 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-29 06:44:30,694 [root] DEBUG: 4104: DLL loaded at 0x00007FFF50370000: C:\\Windows\\system32\\PCPKsp (0x118000 bytes).\n2026-05-29 06:44:30,695 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:44:30,696 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-29 06:44:30,697 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45050000: C:\\Windows\\system32\\ncryptprov (0x5a000 bytes).\n2026-05-29 06:44:30,718 [root] DEBUG: 9656: caller_dispatch: Added region at 0x00007FFF16AB0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFF16CAF156, thread 9660).\n2026-05-29 06:44:30,720 [root] DEBUG: 9656: caller_dispatch: Scanning calling region at 0x00007FFF16AB0000...\n2026-05-29 06:44:30,731 [root] DEBUG: 9656: ProcessTrackedRegion: Region at 0x00007FFF16AB0000 mapped as \\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll appears unmodified, skipping\n2026-05-29 06:44:30,733 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-29 06:44:30,772 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,788 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,803 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,819 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,838 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,853 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,871 [root] DEBUG: 9656: caller_dispatch: Added region at 0x00007FF6C7670000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF6C7764096, thread 9660).\n2026-05-29 06:44:30,871 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8\n2026-05-29 06:44:30,875 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56D00000: C:\\Windows\\system32\\mswsock (0x6a000 bytes).\n2026-05-29 06:44:30,890 [root] DEBUG: 9656: ProcessImageBase: Main module image at 0x00007FF6C7670000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:44:30,893 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:44:30,923 [root] DEBUG: 9656: DLL loaded at 0x0000025931000000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-29 06:44:30,926 [root] DEBUG: 9656: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-29 06:44:30,930 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58380000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-29 06:44:30,970 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 06:44:31,140 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 06:44:31,146 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:44:31,147 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52860000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-29 06:44:31,148 [root] DEBUG: 9656: DLL loaded at 0x00007FFF54850000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-29 06:44:31,148 [root] DEBUG: 9656: DLL loaded at 0x00007FFF46D30000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-29 06:44:31,159 [root] DEBUG: 9656: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-29 06:44:31,162 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-29 06:44:31,162 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-29 06:44:31,163 [root] DEBUG: 9656: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-29 06:44:31,163 [root] DEBUG: 9656: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-29 06:44:31,172 [root] DEBUG: 9656: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-29 06:44:31,184 [root] DEBUG: 9656: DLL loaded at 0x00007FFF46AE0000: C:\\Windows\\system32\\execmodelproxy (0x18000 bytes).\n2026-05-29 06:44:31,196 [root] DEBUG: 9656: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\System32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:44:31,197 [root] DEBUG: 9656: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:44:31,202 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-29 06:44:31,216 [root] DEBUG: 9656: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-29 06:44:31,228 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4CBF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-29 06:44:31,243 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57AA0000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-29 06:44:31,244 [root] DEBUG: 9656: DLL loaded at 0x00007FFF501A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-29 06:44:31,247 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57130000: C:\\Windows\\System32\\MSASN1 (0x12000 bytes).\n2026-05-29 06:44:31,254 [root] DEBUG: 9656: DLL loaded at 0x00007FFF457F0000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-29 06:44:31,271 [root] DEBUG: 9656: DLL loaded at 0x000002592FF50000: C:\\Windows\\System32\\CryptoWinRT (0x61000 bytes).\n2026-05-29 06:44:31,282 [lib.api.process] INFO: Monitor config for process 832: C:\\lpw_albt\\dll\\832.ini\n2026-05-29 06:44:31,283 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:31,285 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:31,292 [root] DEBUG: Loader: Injecting process 832 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:31,297 [root] DEBUG: 832: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:31,297 [root] DEBUG: 832: Disabling sleep skipping.\n2026-05-29 06:44:31,298 [root] DEBUG: 832: Interactive desktop enabled.\n2026-05-29 06:44:31,298 [root] DEBUG: 832: Dropped file limit defaulting to 100.\n2026-05-29 06:44:31,300 [root] DEBUG: 832: Services hook set enabled\n2026-05-29 06:44:31,302 [root] DEBUG: 832: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:31,313 [root] DEBUG: 832: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:44:31,314 [root] DEBUG: 832: Monitor initialised: 64-bit capemon loaded in process 832 at 0x00007FFF18240000, thread 10180, image base 0x00007FF7BF220000, stack from 0x000000CCA7AF4000-0x000000CCA7B00000\n2026-05-29 06:44:31,316 [root] DEBUG: 832: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-05-29 06:44:31,331 [root] DEBUG: 832: Hooked 69 out of 69 functions\n2026-05-29 06:44:31,332 [root] INFO: Loaded monitor into process with pid 832\n2026-05-29 06:44:31,333 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-29 06:44:31,333 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:31,335 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:33,355 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4B780000: C:\\Windows\\System32\\StateRepository.Core (0xb1000 bytes).\n2026-05-29 06:44:33,356 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4B840000: C:\\Windows\\System32\\Windows.StateRepository (0x58e000 bytes).\n2026-05-29 06:44:33,358 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43150000: C:\\Windows\\System32\\TileDataRepository (0x99000 bytes).\n2026-05-29 06:44:33,359 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D7B0000: C:\\Windows\\System32\\biwinrt (0x53000 bytes).\n2026-05-29 06:44:33,368 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4F6E0000: C:\\Windows\\System32\\usermgrproxy (0x54000 bytes).\n2026-05-29 06:44:33,396 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55EF0000: C:\\Windows\\System32\\dxgi (0xf3000 bytes).\n2026-05-29 06:44:33,397 [root] DEBUG: 9656: DLL loaded at 0x00007FFF53070000: C:\\Windows\\System32\\d3d11 (0x263000 bytes).\n2026-05-29 06:44:33,404 [root] DEBUG: 9656: DLL loaded at 0x00007FFF48B40000: C:\\Windows\\System32\\WININET (0x4d6000 bytes).\n2026-05-29 06:44:33,405 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D6A0000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-29 06:44:33,425 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43060000: C:\\Windows\\System32\\PCShellCommonProxyStub (0x13000 bytes).\n2026-05-29 06:44:33,455 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57520000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-05-29 06:44:33,456 [root] DEBUG: 9656: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\System32\\Wldp (0x2d000 bytes).\n2026-05-29 06:44:33,457 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-29 06:44:33,458 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4C520000: C:\\Windows\\System32\\Bcp47Langs (0x5b000 bytes).\n2026-05-29 06:44:33,458 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43DD0000: C:\\Windows\\System32\\StartTileData (0x58a000 bytes).\n2026-05-29 06:44:33,489 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D810000: C:\\Windows\\System32\\Windows.Storage.ApplicationData (0x66000 bytes).\n2026-05-29 06:44:33,579 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4CD40000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-29 06:44:33,622 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-29 06:44:40,168 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 9452: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-29 06:44:40,170 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452\n2026-05-29 06:44:40,170 [lib.api.process] INFO: Monitor config for process 9452: C:\\lpw_albt\\dll\\9452.ini\n2026-05-29 06:44:40,171 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,172 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,177 [root] DEBUG: Loader: Injecting process 9452 (thread 9428) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,178 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:40,179 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,180 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,182 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452\n2026-05-29 06:44:40,182 [lib.api.process] INFO: Monitor config for process 9452: C:\\lpw_albt\\dll\\9452.ini\n2026-05-29 06:44:40,182 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,183 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,188 [root] DEBUG: Loader: Injecting process 9452 (thread 9428) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,188 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:40,189 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,190 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,192 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452\n2026-05-29 06:44:40,192 [lib.api.process] INFO: Monitor config for process 9452: C:\\lpw_albt\\dll\\9452.ini\n2026-05-29 06:44:40,200 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,201 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,214 [root] DEBUG: Loader: Injecting process 9452 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,215 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 9428, handle 0x120\n2026-05-29 06:44:40,216 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:40,217 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,219 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,228 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 10160: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-29 06:44:40,228 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 10160\n2026-05-29 06:44:40,229 [lib.api.process] INFO: Monitor config for process 10160: C:\\lpw_albt\\dll\\10160.ini\n2026-05-29 06:44:40,229 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,230 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,235 [root] DEBUG: Loader: Injecting process 10160 (thread 10156) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,235 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:40,237 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,247 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,250 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 10160\n2026-05-29 06:44:40,251 [lib.api.process] INFO: Monitor config for process 10160: C:\\lpw_albt\\dll\\10160.ini\n2026-05-29 06:44:40,251 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,252 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,261 [root] DEBUG: Loader: Injecting process 10160 (thread 10156) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,262 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:40,263 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,268 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,273 [root] INFO: Process with pid 10160 has terminated\n2026-05-29 06:44:40,279 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 8272: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-29 06:44:40,280 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8272\n2026-05-29 06:44:40,280 [lib.api.process] INFO: Monitor config for process 8272: C:\\lpw_albt\\dll\\8272.ini\n2026-05-29 06:44:40,281 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,289 [root] DEBUG: Loader: Injecting process 8272 (thread 1152) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,289 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:40,290 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,292 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,293 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8272\n2026-05-29 06:44:40,293 [lib.api.process] INFO: Monitor config for process 8272: C:\\lpw_albt\\dll\\8272.ini\n2026-05-29 06:44:40,293 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,294 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,298 [root] DEBUG: Loader: Injecting process 8272 (thread 1152) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,299 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:40,301 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,302 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,303 [root] INFO: Process with pid 8272 has terminated\n2026-05-29 06:44:40,307 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 9120: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-29 06:44:40,308 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9120\n2026-05-29 06:44:40,308 [lib.api.process] INFO: Monitor config for process 9120: C:\\lpw_albt\\dll\\9120.ini\n2026-05-29 06:44:40,309 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,310 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,316 [root] DEBUG: Loader: Injecting process 9120 (thread 1880) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,317 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:40,317 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,319 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,320 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9120\n2026-05-29 06:44:40,320 [lib.api.process] INFO: Monitor config for process 9120: C:\\lpw_albt\\dll\\9120.ini\n2026-05-29 06:44:40,321 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:40,322 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:40,326 [root] DEBUG: Loader: Injecting process 9120 (thread 1880) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,326 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:40,328 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:40,330 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:40,332 [root] INFO: Process with pid 9120 has terminated\n2026-05-29 06:44:43,727 [root] INFO: Process with pid 9656 has terminated\n2026-05-29 06:44:43,728 [root] DEBUG: 9656: NtTerminateProcess hook: Attempting to dump process 9656\n2026-05-29 06:44:43,730 [root] DEBUG: 9656: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:44:46,682 [root] INFO: Announced starting service \"b'edgeupdate'\"\n2026-05-29 06:44:46,682 [lib.api.process] INFO: Monitor config for process 676: C:\\lpw_albt\\dll\\676.ini\n2026-05-29 06:44:46,683 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:46,684 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:44:46,688 [root] DEBUG: Loader: Injecting process 676 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:46,689 [root] DEBUG: Loader: Copied config file C:\\lpw_albt\\dll\\676.ini to system path C:\\676.ini\n2026-05-29 06:44:46,692 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 676 C:\\lpw_albt\\dll\\yCvZHFYF.dll\n2026-05-29 06:44:46,692 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:44:46,693 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:44:47,916 [root] DEBUG: 676: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:47,924 [root] DEBUG: 676: Disabling sleep skipping.\n2026-05-29 06:44:47,925 [root] DEBUG: 676: Interactive desktop enabled.\n2026-05-29 06:44:47,926 [root] DEBUG: 676: Dropped file limit defaulting to 100.\n2026-05-29 06:44:47,929 [root] DEBUG: 676: Services hook set enabled\n2026-05-29 06:44:47,945 [root] DEBUG: 676: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:44:47,945 [root] DEBUG: 676: Monitor initialised: 64-bit capemon loaded in process 676 at 0x00007FFEFAB30000, thread 6500, image base 0x00007FF7839A0000, stack from 0x000000F2F01F2000-0x000000F2F0200000\n2026-05-29 06:44:47,945 [root] DEBUG: 676: Commandline: C:\\Windows\\system32\\services.exe\n2026-05-29 06:44:47,960 [root] DEBUG: 676: Hooked 69 out of 69 functions\n2026-05-29 06:44:47,963 [root] INFO: Loaded monitor into process with pid 676\n2026-05-29 06:44:49,812 [root] DEBUG: 676: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\system32\\Wldp (0x2d000 bytes).\n2026-05-29 06:44:49,819 [root] DEBUG: 676: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-29 06:44:49,831 [root] DEBUG: 676: DLL loaded at 0x00007FFF58070000: C:\\Windows\\system32\\SHCORE (0xad000 bytes).\n2026-05-29 06:44:49,848 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 5932: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe, ImageBase: 0x0000000000150000\n2026-05-29 06:44:49,864 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932\n2026-05-29 06:44:49,872 [lib.api.process] INFO: Monitor config for process 5932: C:\\lpw_albt\\dll\\5932.ini\n2026-05-29 06:44:49,873 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:49,906 [lib.api.process] INFO: 32-bit DLL to inject is C:\\lpw_albt\\dll\\nxatNo.dll, loader C:\\lpw_albt\\bin\\pNxCcCJ.exe\n2026-05-29 06:44:49,990 [root] DEBUG: Loader: Injecting process 5932 (thread 5888) with C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:49,992 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:49,992 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:49,996 [lib.api.process] INFO: Injected into 32-bit \n2026-05-29 06:44:49,998 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932\n2026-05-29 06:44:49,998 [lib.api.process] INFO: Monitor config for process 5932: C:\\lpw_albt\\dll\\5932.ini\n2026-05-29 06:44:49,999 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:50,000 [lib.api.process] INFO: 32-bit DLL to inject is C:\\lpw_albt\\dll\\nxatNo.dll, loader C:\\lpw_albt\\bin\\pNxCcCJ.exe\n2026-05-29 06:44:50,006 [root] DEBUG: Loader: Injecting process 5932 (thread 5888) with C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:50,007 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:44:50,007 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:50,009 [lib.api.process] INFO: Injected into 32-bit \n2026-05-29 06:44:50,009 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932\n2026-05-29 06:44:50,010 [lib.api.process] INFO: Monitor config for process 5932: C:\\lpw_albt\\dll\\5932.ini\n2026-05-29 06:44:50,010 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:50,011 [lib.api.process] INFO: 32-bit DLL to inject is C:\\lpw_albt\\dll\\nxatNo.dll, loader C:\\lpw_albt\\bin\\pNxCcCJ.exe\n2026-05-29 06:44:50,016 [root] DEBUG: Loader: Injecting process 5932 with C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:50,017 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.\n2026-05-29 06:44:50,074 [root] DEBUG: 5932: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:50,075 [root] DEBUG: 5932: Interactive desktop enabled.\n2026-05-29 06:44:50,076 [root] DEBUG: 5932: Dropped file limit defaulting to 100.\n2026-05-29 06:44:50,080 [root] DEBUG: 5932: Disabling sleep skipping.\n2026-05-29 06:44:50,091 [root] DEBUG: 5932: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:50,091 [root] DEBUG: 5932: YaraScan: Scanning 0x00150000, size 0x34220\n2026-05-29 06:44:50,093 [root] DEBUG: 5932: Monitor initialised: 32-bit capemon loaded in process 5932 at 0x6ab90000, thread 9680, image base 0x150000, stack from 0x2734000-0x2740000\n2026-05-29 06:44:50,094 [root] DEBUG: 5932: Commandline: \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc\n2026-05-29 06:44:50,128 [root] DEBUG: 5932: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress\n2026-05-29 06:44:50,153 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-05-29 06:44:50,153 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-05-29 06:44:50,159 [root] DEBUG: 5932: Hooked 632 out of 632 functions\n2026-05-29 06:44:50,162 [root] DEBUG: 5932: Syscall hook installed, syscall logging level 1\n2026-05-29 06:44:50,170 [root] DEBUG: 5932: RestoreHeaders: Restored original import table.\n2026-05-29 06:44:50,172 [root] INFO: Loaded monitor into process with pid 5932\n2026-05-29 06:44:50,172 [root] DEBUG: 5932: caller_dispatch: Added region at 0x023D0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x023D0035, thread 9680).\n2026-05-29 06:44:50,173 [root] DEBUG: 5932: DumpPEsInRange: Scanning range 0x023D0000 - 0x023D0127.\n2026-05-29 06:44:50,173 [root] DEBUG: 5932: ScanForDisguisedPE: Size too small: 0x127 bytes\n2026-05-29 06:44:50,186 [lib.common.results] INFO: Uploading file C:\\gZRInK\\CAPE\\5932_284721350441029552026 to CAPE\\760e3c46aa0d294ae0c9528bdd5ad0e57b0e0a20301b2e3a7ca6bd400b7ee76a; Size is 295; Max size: 100000000\n2026-05-29 06:44:50,194 [root] DEBUG: 5932: DumpMemory: Payload successfully created: C:\\gZRInK\\CAPE\\5932_284721350441029552026 (size 295 bytes)\n2026-05-29 06:44:50,194 [root] DEBUG: 5932: DumpRegion: Dumped entire allocation from 0x023D0000, size 4096 bytes.\n2026-05-29 06:44:50,195 [root] DEBUG: 5932: ProcessTrackedRegion: Dumped region at 0x023D0000.\n2026-05-29 06:44:50,195 [root] DEBUG: 5932: YaraScan: Scanning 0x023D0000, size 0x127\n2026-05-29 06:44:50,196 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-29 06:44:50,197 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:50,199 [lib.api.process] INFO: Injected into 32-bit \n2026-05-29 06:44:50,200 [root] DEBUG: 5932: caller_dispatch: Added region at 0x00150000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0015D98E, thread 5888).\n2026-05-29 06:44:50,200 [root] DEBUG: 5932: YaraScan: Scanning 0x00150000, size 0x34220\n2026-05-29 06:44:50,203 [root] DEBUG: 5932: ProcessImageBase: Main module image at 0x00150000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:44:50,210 [root] DEBUG: 5932: DLL loaded at 0x74A30000: C:\\Windows\\SYSTEM32\\Wldp (0x24000 bytes).\n2026-05-29 06:44:50,210 [root] DEBUG: 5932: DLL loaded at 0x74A60000: C:\\Windows\\SYSTEM32\\windows.storage (0x613000 bytes).\n2026-05-29 06:44:50,220 [root] DEBUG: 5932: DLL loaded at 0x75F00000: C:\\Windows\\System32\\SHCORE (0x87000 bytes).\n2026-05-29 06:44:50,233 [root] DEBUG: 5932: DLL loaded at 0x70670000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x14000 bytes).\n2026-05-29 06:44:50,234 [root] DEBUG: 5932: DLL loaded at 0x75460000: C:\\Windows\\SYSTEM32\\VERSION (0x8000 bytes).\n2026-05-29 06:44:50,235 [root] DEBUG: 5932: DLL loaded at 0x75450000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0xf000 bytes).\n2026-05-29 06:44:50,235 [root] DEBUG: 5932: DLL loaded at 0x74890000: C:\\Windows\\SYSTEM32\\NETUTILS (0xb000 bytes).\n2026-05-29 06:44:50,236 [root] DEBUG: 5932: DLL loaded at 0x748A0000: C:\\Windows\\SYSTEM32\\WKSCLI (0x11000 bytes).\n2026-05-29 06:44:50,237 [root] DEBUG: 5932: DLL loaded at 0x6AEB0000: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate (0x23d000 bytes).\n2026-05-29 06:44:50,252 [root] DEBUG: 5932: DLL loaded at 0x6EBD0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-29 06:44:50,253 [root] DEBUG: 5932: DLL loaded at 0x755E0000: C:\\Windows\\system32\\MDMRegistration (0x53000 bytes).\n2026-05-29 06:44:50,269 [root] DEBUG: 5932: DLL loaded at 0x6F2A0000: C:\\Windows\\SYSTEM32\\powrprof (0x44000 bytes).\n2026-05-29 06:44:50,270 [root] DEBUG: 5932: DLL loaded at 0x741D0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x13000 bytes).\n2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x70D00000: C:\\Windows\\SYSTEM32\\ncrypt (0x21000 bytes).\n2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x76790000: C:\\Windows\\System32\\imagehlp (0x19000 bytes).\n2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x75520000: C:\\Windows\\SYSTEM32\\tbs (0x13000 bytes).\n2026-05-29 06:44:50,272 [root] DEBUG: 5932: DLL loaded at 0x75540000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x63000 bytes).\n2026-05-29 06:44:50,272 [root] DEBUG: 5932: DLL loaded at 0x755B0000: C:\\Windows\\SYSTEM32\\omadmapi (0x2c000 bytes).\n2026-05-29 06:44:50,274 [root] DEBUG: 5932: DLL loaded at 0x6F290000: C:\\Windows\\SYSTEM32\\UMPDC (0xd000 bytes).\n2026-05-29 06:44:50,276 [root] DEBUG: 5932: DLL loaded at 0x70200000: C:\\Windows\\SYSTEM32\\NTASN1 (0x28000 bytes).\n2026-05-29 06:44:50,283 [root] DEBUG: 5932: DLL loaded at 0x6EBD0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-29 06:44:50,284 [root] DEBUG: 5932: DLL loaded at 0x741D0000: C:\\Windows\\SYSTEM32\\cryptsp (0x13000 bytes).\n2026-05-29 06:44:50,287 [root] DEBUG: 5932: DLL loaded at 0x6EC40000: C:\\Windows\\SYSTEM32\\DSREG (0x107000 bytes).\n2026-05-29 06:44:50,302 [root] DEBUG: 5932: DLL loaded at 0x74180000: C:\\Windows\\SYSTEM32\\profapi (0x1c000 bytes).\n2026-05-29 06:44:50,339 [root] DEBUG: 5932: api-rate-cap: NtWaitForSingleObject hook disabled due to rate\n2026-05-29 06:44:50,346 [root] DEBUG: 5932: DLL loaded at 0x74950000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-05-29 06:44:50,358 [root] DEBUG: 5932: DLL loaded at 0x75DF0000: C:\\Windows\\System32\\bcryptPrimitives (0x5f000 bytes).\n2026-05-29 06:44:50,365 [root] DEBUG: 5932: DLL loaded at 0x76650000: C:\\Windows\\System32\\clbcatq (0x7e000 bytes).\n2026-05-29 06:44:50,382 [root] DEBUG: 5932: DLL loaded at 0x755E0000: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\psmachine (0x58000 bytes).\n2026-05-29 06:44:50,681 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.\n2026-05-29 06:44:50,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6408, handle 0x3c4: Error obtaining target process name\n2026-05-29 06:44:50,871 [root] DEBUG: 5932: DLL loaded at 0x75580000: C:\\Windows\\System32\\SystemSettings.DataModel (0x57000 bytes).\n2026-05-29 06:44:50,873 [root] DEBUG: 5932: caller_dispatch: Added region at 0x75580000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x755AB711, thread 10280).\n2026-05-29 06:44:50,874 [root] DEBUG: 5932: ProcessTrackedRegion: Region at 0x75580000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\SystemSettings.DataModel.dll is in known range, skipping\n2026-05-29 06:44:50,882 [root] DEBUG: 5932: DLL loaded at 0x75410000: C:\\Windows\\SYSTEM32\\USERENV (0x25000 bytes).\n2026-05-29 06:44:50,895 [root] DEBUG: 5932: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-29 06:44:50,896 [root] DEBUG: 5932: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-29 06:44:50,906 [root] DEBUG: 5932: DLL loaded at 0x6FCF0000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x3ba000 bytes).\n2026-05-29 06:44:50,941 [root] DEBUG: 5932: DLL loaded at 0x77270000: C:\\Windows\\System32\\CFGMGR32 (0x3b000 bytes).\n2026-05-29 06:44:50,951 [root] DEBUG: 5932: DLL loaded at 0x754F0000: C:\\Windows\\System32\\StructuredQuery (0x81000 bytes).\n2026-05-29 06:44:50,967 [root] DEBUG: 5932: DLL loaded at 0x70910000: C:\\Windows\\SYSTEM32\\PROPSYS (0xc2000 bytes).\n2026-05-29 06:44:50,980 [root] DEBUG: 5932: DLL loaded at 0x6AAF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x93000 bytes).\n2026-05-29 06:44:51,018 [root] DEBUG: 5932: DLL loaded at 0x6AA50000: C:\\Windows\\system32\\Windows.Storage.Search (0x9d000 bytes).\n2026-05-29 06:44:51,060 [root] DEBUG: 5932: DLL loaded at 0x754E0000: C:\\Windows\\SYSTEM32\\LINKINFO (0xb000 bytes).\n2026-05-29 06:44:51,123 [root] DEBUG: 5932: DLL loaded at 0x6F0B0000: C:\\Windows\\System32\\msxml6 (0x1dd000 bytes).\n2026-05-29 06:44:51,136 [root] DEBUG: 5932: DLL loaded at 0x6AE60000: C:\\Windows\\SYSTEM32\\WINSTA (0x47000 bytes).\n2026-05-29 06:44:51,156 [root] DEBUG: 5932: DLL loaded at 0x75340000: C:\\Windows\\system32\\winhttp (0xca000 bytes).\n2026-05-29 06:44:51,161 [root] DEBUG: 5932: DLL loaded at 0x6E3B0000: C:\\Windows\\system32\\OnDemandConnRouteHelper (0x12000 bytes).\n2026-05-29 06:44:51,165 [root] DEBUG: 5932: DLL loaded at 0x73FA0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x32000 bytes).\n2026-05-29 06:44:51,166 [root] DEBUG: 5932: DLL loaded at 0x76290000: C:\\Windows\\System32\\NSI (0x7000 bytes).\n2026-05-29 06:44:51,170 [root] DEBUG: 5932: DLL loaded at 0x6BC10000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x14000 bytes).\n2026-05-29 06:44:51,173 [root] DEBUG: 5932: DLL loaded at 0x73F80000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x16000 bytes).\n2026-05-29 06:44:51,185 [root] DEBUG: 5932: DLL loaded at 0x6A9D0000: C:\\Windows\\SYSTEM32\\webio (0x73000 bytes).\n2026-05-29 06:44:51,190 [root] DEBUG: 5932: DLL loaded at 0x6E350000: C:\\Windows\\system32\\mswsock (0x52000 bytes).\n2026-05-29 06:44:51,200 [root] DEBUG: 5932: DLL loaded at 0x6E2F0000: C:\\Windows\\SYSTEM32\\WINNSI (0x8000 bytes).\n2026-05-29 06:44:51,207 [root] DEBUG: 5932: DLL loaded at 0x702C0000: C:\\Windows\\SYSTEM32\\DNSAPI (0x90000 bytes).\n2026-05-29 06:44:51,212 [root] DEBUG: 5932: DLL loaded at 0x6D030000: C:\\Windows\\System32\\rasadhlp (0x8000 bytes).\n2026-05-29 06:44:51,256 [root] DEBUG: 5932: DLL loaded at 0x6CFD0000: C:\\Windows\\System32\\fwpuclnt (0x58000 bytes).\n2026-05-29 06:44:51,629 [root] DEBUG: 5932: DLL loaded at 0x6CF50000: C:\\Windows\\System32\\schannel (0x7c000 bytes).\n2026-05-29 06:44:52,290 [root] DEBUG: 4104: DLL loaded at 0x00007FFF18180000: C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).\n2026-05-29 06:44:52,291 [root] DEBUG: 5932: DLL loaded at 0x6CF40000: C:\\Windows\\SYSTEM32\\mskeyprotect (0x10000 bytes).\n2026-05-29 06:44:52,292 [root] DEBUG: 5932: DLL loaded at 0x70200000: C:\\Windows\\SYSTEM32\\NTASN1 (0x28000 bytes).\n2026-05-29 06:44:52,293 [root] DEBUG: 5932: DLL loaded at 0x70D00000: C:\\Windows\\SYSTEM32\\ncrypt (0x21000 bytes).\n2026-05-29 06:44:52,295 [root] DEBUG: 5932: DLL loaded at 0x6CEF0000: C:\\Windows\\system32\\ncryptsslp (0x1f000 bytes).\n2026-05-29 06:44:52,297 [root] DEBUG: 5932: DLL loaded at 0x701B0000: C:\\Windows\\SYSTEM32\\MSASN1 (0xe000 bytes).\n2026-05-29 06:44:52,386 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 10500: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:52,387 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 10500\n2026-05-29 06:44:52,388 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 10500\n2026-05-29 06:44:52,645 [root] DEBUG: Error 87 (0x57) - OpenProcessHandler: Error obtaining target process name: The parameter is incorrect.\n2026-05-29 06:44:52,647 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4, handle 0x73c: Error obtaining target process name\n2026-05-29 06:44:52,647 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 124, handle 0x73c:\n2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 384, handle 0x73c: C:\\Windows\\System32\\smss.exe\n2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 480, handle 0x73c: C:\\Windows\\System32\\csrss.exe\n2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 556, handle 0x73c: C:\\Windows\\System32\\wininit.exe\n2026-05-29 06:44:52,649 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 576, handle 0x73c: C:\\Windows\\System32\\csrss.exe\n2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 656, handle 0x73c: C:\\Windows\\System32\\winlogon.exe\n2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 676, handle 0x73c: C:\\Windows\\System32\\services.exe\n2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 724, handle 0x73c: C:\\Windows\\System32\\lsass.exe\n2026-05-29 06:44:52,651 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 832, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,651 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 860, handle 0x73c: C:\\Windows\\System32\\fontdrvhost.exe\n2026-05-29 06:44:52,652 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 868, handle 0x73c: C:\\Windows\\System32\\fontdrvhost.exe\n2026-05-29 06:44:52,652 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 948, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,653 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1004, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,653 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 472, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,654 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 772, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,654 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1048, handle 0x73c: C:\\Windows\\System32\\dwm.exe\n2026-05-29 06:44:52,655 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1096, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,655 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1136, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,656 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1164, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,656 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1268, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,657 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1284, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,657 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1292, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1308, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1352, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1444, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,659 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1596, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,661 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1632, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,661 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1644, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,662 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1664, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,662 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1828, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,663 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1852, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,663 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1860, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,664 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1868, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,664 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1992, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,665 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2020, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,665 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2036, handle 0x73c:\n2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2124, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2224, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2240, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,667 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2296, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,667 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2344, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,668 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2456, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,668 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2472, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2520, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2696, handle 0x73c: C:\\Windows\\System32\\spoolsv.exe\n2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2724, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,670 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2772, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,670 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2876, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,671 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2896, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,671 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3012, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,672 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3020, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,672 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3040, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,673 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3048, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,673 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3056, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,674 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2292, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,674 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2820, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,675 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3396, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,676 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3892, handle 0x73c: C:\\Windows\\System32\\SearchIndexer.exe\n2026-05-29 06:44:52,677 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3992, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,677 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3500, handle 0x73c: C:\\Windows\\System32\\sihost.exe\n2026-05-29 06:44:52,678 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3416, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,678 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4148, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,679 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4240, handle 0x73c: C:\\Windows\\System32\\taskhostw.exe\n2026-05-29 06:44:52,679 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4300, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,680 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4380, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,680 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4484, handle 0x73c: C:\\Windows\\explorer.exe\n2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4524, handle 0x73c: C:\\Windows\\System32\\ctfmon.exe\n2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4592, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4788, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4916, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5200, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5260, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5544, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5624, handle 0x73c: C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe\n2026-05-29 06:44:52,684 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5688, handle 0x73c: C:\\Windows\\System32\\RuntimeBroker.exe\n2026-05-29 06:44:52,684 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5800, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,685 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5892, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,685 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6008, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,686 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6136, handle 0x73c: C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp.exe\n2026-05-29 06:44:52,686 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5948, handle 0x73c: C:\\Windows\\System32\\RuntimeBroker.exe\n2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6436, handle 0x73c: C:\\Windows\\System32\\RuntimeBroker.exe\n2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6616, handle 0x73c: C:\\Windows\\System32\\taskhostw.exe\n2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6996, handle 0x73c: C:\\Windows\\System32\\smartscreen.exe\n2026-05-29 06:44:52,688 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7052, handle 0x73c: C:\\Windows\\System32\\SecurityHealthSystray.exe\n2026-05-29 06:44:52,688 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7088, handle 0x73c: C:\\Windows\\System32\\SecurityHealthService.exe\n2026-05-29 06:44:52,689 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6284, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,689 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3976, handle 0x73c: C:\\Windows\\System32\\conhost.exe\n2026-05-29 06:44:52,690 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1104, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\n2026-05-29 06:44:52,690 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5128, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,691 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6768, handle 0x73c: C:\\Program Files (x86)\\Steam\\steam.exe\n2026-05-29 06:44:52,692 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6400, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,693 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6356, handle 0x73c: C:\\Program Files (x86)\\Common Files\\Steam\\steamservice.exe\n2026-05-29 06:44:52,693 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6360, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6392, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2160, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6512, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,695 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6504, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,695 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7444, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,696 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7544, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,696 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7844, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,697 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8100, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,697 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8340, handle 0x73c: C:\\Users\\admin\\AppData\\Local\\Discord\\app-1.0.9238\\Discord.exe\n2026-05-29 06:44:52,698 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8108, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,698 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3820, handle 0x73c: C:\\Program Files (x86)\\Steam\\bin\\cef\\cef.win64\\steamwebhelper.exe\n2026-05-29 06:44:52,699 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8044, handle 0x73c: C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe\n2026-05-29 06:44:52,699 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1740, handle 0x73c: C:\\Windows\\System32\\dllhost.exe\n2026-05-29 06:44:52,700 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1316, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,700 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3404, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,701 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5364, handle 0x73c: C:\\Windows\\System32\\SgrmBroker.exe\n2026-05-29 06:44:52,701 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6640, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2580, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6028, handle 0x73c: C:\\Windows\\System32\\MoUsoCoreWorker.exe\n2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6188, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,703 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5116, handle 0x73c: C:\\Windows\\System32\\backgroundTaskHost.exe\n2026-05-29 06:44:52,703 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8828, handle 0x73c: C:\\Windows\\System32\\CompatTelRunner.exe\n2026-05-29 06:44:52,704 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6280, handle 0x73c: C:\\Windows\\servicing\\TrustedInstaller.exe\n2026-05-29 06:44:52,704 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1028, handle 0x73c: C:\\Windows\\System32\\notepad.exe\n2026-05-29 06:44:52,705 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4932, handle 0x73c: C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe\n2026-05-29 06:44:52,706 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1016, handle 0x73c: C:\\Windows\\System32\\RuntimeBroker.exe\n2026-05-29 06:44:52,708 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2016, handle 0x73c: C:\\Windows\\System32\\conhost.exe\n2026-05-29 06:44:52,709 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2672, handle 0x73c: C:\\Windows\\System32\\RuntimeBroker.exe\n2026-05-29 06:44:52,709 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6568, handle 0x73c: C:\\Windows\\System32\\CompatTelRunner.exe\n2026-05-29 06:44:52,710 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5040, handle 0x73c: C:\\Windows\\System32\\sppsvc.exe\n2026-05-29 06:44:52,710 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2916, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,711 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8700, handle 0x73c: C:\\Windows\\System32\\wbem\\WmiPrvSE.exe\n2026-05-29 06:44:52,712 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4104, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,712 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1204, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,713 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2168, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,713 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1332, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,714 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4760, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,714 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4108, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,715 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5820, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,715 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8604, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8504, handle 0x73c: C:\\Windows\\System32\\wbem\\WmiPrvSE.exe\n2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7080, handle 0x73c: C:\\Windows\\System32\\wbem\\WmiPrvSE.exe\n2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9328, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,717 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9344, handle 0x73c: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n2026-05-29 06:44:52,717 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9568, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,718 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2464, handle 0x73c: C:\\Windows\\System32\\svchost.exe\n2026-05-29 06:44:52,732 [root] DEBUG: 5932: DLL loaded at 0x6E2E0000: C:\\Windows\\SYSTEM32\\DPAPI (0x8000 bytes).\n2026-05-29 06:44:52,733 [root] DEBUG: 5932: CreateProcessHandler: Injection info set for new process 11132: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe, ImageBase: 0x00150000\n2026-05-29 06:44:52,734 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 11132\n2026-05-29 06:44:52,734 [lib.api.process] INFO: Monitor config for process 11132: C:\\lpw_albt\\dll\\11132.ini\n2026-05-29 06:44:52,735 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:44:52,736 [lib.api.process] INFO: 32-bit DLL to inject is C:\\lpw_albt\\dll\\nxatNo.dll, loader C:\\lpw_albt\\bin\\pNxCcCJ.exe\n2026-05-29 06:44:52,743 [root] DEBUG: Loader: Injecting process 11132 (thread 11136) with C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:52,744 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:44:52,744 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\nxatNo.dll.\n2026-05-29 06:44:52,745 [lib.api.process] INFO: Injected into 32-bit \n2026-05-29 06:44:52,747 [root] DEBUG: 5932: DLL loaded at 0x74960000: C:\\Windows\\system32\\apphelp (0x9f000 bytes).\n2026-05-29 06:44:52,754 [root] DEBUG: 11132: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:44:52,755 [root] DEBUG: 11132: Interactive desktop enabled.\n2026-05-29 06:44:52,755 [root] DEBUG: 11132: Dropped file limit defaulting to 100.\n2026-05-29 06:44:52,757 [root] DEBUG: 11132: Disabling sleep skipping.\n2026-05-29 06:44:52,759 [root] DEBUG: 11132: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:44:52,760 [root] DEBUG: 11132: YaraScan: Scanning 0x00150000, size 0x34220\n2026-05-29 06:44:52,761 [root] DEBUG: 11132: Monitor initialised: 32-bit capemon loaded in process 11132 at 0x6ab90000, thread 11136, image base 0x150000, stack from 0x2cf5000-0x2d00000\n2026-05-29 06:44:52,762 [root] DEBUG: 11132: Commandline: \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4M\n2026-05-29 06:44:52,784 [root] DEBUG: 11132: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress\n2026-05-29 06:44:52,802 [root] DEBUG: 11132: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-05-29 06:44:52,803 [root] DEBUG: 11132: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-05-29 06:44:52,807 [root] DEBUG: 11132: Hooked 632 out of 632 functions\n2026-05-29 06:44:52,808 [root] DEBUG: 11132: Syscall hook installed, syscall logging level 1\n2026-05-29 06:44:52,812 [root] DEBUG: 11132: RestoreHeaders: Restored original import table.\n2026-05-29 06:44:52,812 [root] INFO: Loaded monitor into process with pid 11132\n2026-05-29 06:44:52,813 [root] DEBUG: 11132: caller_dispatch: Added region at 0x00150000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0015D98E, thread 11136).\n2026-05-29 06:44:52,814 [root] DEBUG: 11132: YaraScan: Scanning 0x00150000, size 0x34220\n2026-05-29 06:44:52,815 [root] DEBUG: 11132: ProcessImageBase: Main module image at 0x00150000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:44:52,818 [root] DEBUG: 11132: DLL loaded at 0x74A30000: C:\\Windows\\SYSTEM32\\Wldp (0x24000 bytes).\n2026-05-29 06:44:52,819 [root] DEBUG: 11132: DLL loaded at 0x74A60000: C:\\Windows\\SYSTEM32\\windows.storage (0x613000 bytes).\n2026-05-29 06:44:52,820 [root] DEBUG: 11132: DLL loaded at 0x75F00000: C:\\Windows\\System32\\SHCORE (0x87000 bytes).\n2026-05-29 06:44:52,823 [root] DEBUG: 11132: DLL loaded at 0x70670000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x14000 bytes).\n2026-05-29 06:44:52,824 [root] DEBUG: 11132: DLL loaded at 0x75460000: C:\\Windows\\SYSTEM32\\VERSION (0x8000 bytes).\n2026-05-29 06:44:52,824 [root] DEBUG: 11132: DLL loaded at 0x75450000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0xf000 bytes).\n2026-05-29 06:44:52,825 [root] DEBUG: 11132: DLL loaded at 0x74890000: C:\\Windows\\SYSTEM32\\NETUTILS (0xb000 bytes).\n2026-05-29 06:44:52,825 [root] DEBUG: 11132: DLL loaded at 0x748A0000: C:\\Windows\\SYSTEM32\\WKSCLI (0x11000 bytes).\n2026-05-29 06:44:52,826 [root] DEBUG: 11132: DLL loaded at 0x6AEB0000: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.233.3\\msedgeupdate (0x23d000 bytes).\n2026-05-29 06:44:52,832 [root] DEBUG: 11132: DLL loaded at 0x6EBD0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-29 06:44:52,833 [root] DEBUG: 11132: DLL loaded at 0x6A970000: C:\\Windows\\system32\\MDMRegistration (0x53000 bytes).\n2026-05-29 06:44:52,839 [root] DEBUG: 11132: DLL loaded at 0x6F2A0000: C:\\Windows\\SYSTEM32\\powrprof (0x44000 bytes).\n2026-05-29 06:44:52,840 [root] DEBUG: 11132: DLL loaded at 0x741D0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x13000 bytes).\n2026-05-29 06:44:52,841 [root] DEBUG: 11132: DLL loaded at 0x70D00000: C:\\Windows\\SYSTEM32\\ncrypt (0x21000 bytes).\n2026-05-29 06:44:52,841 [root] DEBUG: 11132: DLL loaded at 0x76790000: C:\\Windows\\System32\\imagehlp (0x19000 bytes).\n2026-05-29 06:44:52,842 [root] DEBUG: 11132: DLL loaded at 0x6A8E0000: C:\\Windows\\SYSTEM32\\tbs (0x13000 bytes).\n2026-05-29 06:44:52,842 [root] DEBUG: 11132: DLL loaded at 0x6A900000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x63000 bytes).\n2026-05-29 06:44:52,843 [root] DEBUG: 11132: DLL loaded at 0x754B0000: C:\\Windows\\SYSTEM32\\omadmapi (0x2c000 bytes).\n2026-05-29 06:44:52,849 [root] DEBUG: 11132: DLL loaded at 0x6F290000: C:\\Windows\\SYSTEM32\\UMPDC (0xd000 bytes).\n2026-05-29 06:44:52,851 [root] DEBUG: 11132: DLL loaded at 0x70200000: C:\\Windows\\SYSTEM32\\NTASN1 (0x28000 bytes).\n2026-05-29 06:44:52,854 [root] DEBUG: 11132: DLL loaded at 0x6EBD0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-29 06:44:52,854 [root] DEBUG: 11132: DLL loaded at 0x741D0000: C:\\Windows\\SYSTEM32\\cryptsp (0x13000 bytes).\n2026-05-29 06:44:52,855 [root] DEBUG: 11132: DLL loaded at 0x6EC40000: C:\\Windows\\SYSTEM32\\DSREG (0x107000 bytes).\n2026-05-29 06:44:52,859 [root] DEBUG: 11132: DLL loaded at 0x74180000: C:\\Windows\\SYSTEM32\\profapi (0x1c000 bytes).\n2026-05-29 06:44:52,880 [root] DEBUG: 11132: DLL loaded at 0x74950000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-05-29 06:44:52,881 [root] DEBUG: 11132: DLL loaded at 0x75DF0000: C:\\Windows\\System32\\bcryptPrimitives (0x5f000 bytes).\n2026-05-29 06:44:52,884 [root] DEBUG: 11132: DLL loaded at 0x6AE60000: C:\\Windows\\SYSTEM32\\WINSTA (0x47000 bytes).\n2026-05-29 06:44:52,890 [root] DEBUG: 11132: DLL loaded at 0x73FA0000: C:\\Windows\\SYSTEM32\\Iphlpapi (0x32000 bytes).\n2026-05-29 06:44:52,891 [root] DEBUG: 11132: DLL loaded at 0x76290000: C:\\Windows\\System32\\NSI (0x7000 bytes).\n2026-05-29 06:44:52,893 [root] DEBUG: 11132: DLL loaded at 0x73F80000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x16000 bytes).\n2026-05-29 06:44:52,895 [root] DEBUG: 11132: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-29 06:44:52,895 [root] DEBUG: 11132: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-29 06:44:52,898 [root] DEBUG: 11132: DLL loaded at 0x73E90000: C:\\Windows\\SYSTEM32\\diagnosticdataquery (0xc000 bytes).\n2026-05-29 06:44:52,899 [root] DEBUG: 11132: DLL loaded at 0x76650000: C:\\Windows\\System32\\clbcatq (0x7e000 bytes).\n2026-05-29 06:44:52,900 [root] DEBUG: 11132: DLL loaded at 0x6F0B0000: C:\\Windows\\System32\\msxml6 (0x1dd000 bytes).\n2026-05-29 06:44:52,906 [root] DEBUG: 11132: DLL loaded at 0x73EB0000: C:\\Windows\\System32\\netprofm (0x32000 bytes).\n2026-05-29 06:44:52,916 [root] DEBUG: 11132: DLL loaded at 0x73EA0000: C:\\Windows\\System32\\npmproxy (0xa000 bytes).\n2026-05-29 06:44:52,932 [root] DEBUG: 11132: DLL loaded at 0x75340000: C:\\Windows\\system32\\winhttp (0xca000 bytes).\n2026-05-29 06:44:52,934 [root] DEBUG: 11132: DLL loaded at 0x6E3B0000: C:\\Windows\\system32\\OnDemandConnRouteHelper (0x12000 bytes).\n2026-05-29 06:44:52,938 [root] DEBUG: 11132: DLL loaded at 0x6BC10000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x14000 bytes).\n2026-05-29 06:44:52,950 [root] DEBUG: 11132: DLL loaded at 0x6A9D0000: C:\\Windows\\SYSTEM32\\webio (0x73000 bytes).\n2026-05-29 06:44:52,951 [root] DEBUG: 11132: DLL loaded at 0x6E350000: C:\\Windows\\system32\\mswsock (0x52000 bytes).\n2026-05-29 06:44:52,952 [root] DEBUG: 11132: DLL loaded at 0x6E2F0000: C:\\Windows\\SYSTEM32\\WINNSI (0x8000 bytes).\n2026-05-29 06:44:52,957 [root] DEBUG: 11132: DLL loaded at 0x702C0000: C:\\Windows\\SYSTEM32\\DNSAPI (0x90000 bytes).\n2026-05-29 06:44:52,958 [root] DEBUG: 11132: DLL loaded at 0x6D030000: C:\\Windows\\System32\\rasadhlp (0x8000 bytes).\n2026-05-29 06:44:52,983 [root] DEBUG: 11132: DLL loaded at 0x6CFD0000: C:\\Windows\\System32\\fwpuclnt (0x58000 bytes).\n2026-05-29 06:44:53,005 [root] DEBUG: 11132: DLL loaded at 0x6CF50000: C:\\Windows\\System32\\schannel (0x7c000 bytes).\n2026-05-29 06:44:53,029 [root] DEBUG: 11132: DLL loaded at 0x6CF40000: C:\\Windows\\SYSTEM32\\mskeyprotect (0x10000 bytes).\n2026-05-29 06:44:53,029 [root] DEBUG: 11132: DLL loaded at 0x70200000: C:\\Windows\\SYSTEM32\\NTASN1 (0x28000 bytes).\n2026-05-29 06:44:53,030 [root] DEBUG: 11132: DLL loaded at 0x70D00000: C:\\Windows\\SYSTEM32\\ncrypt (0x21000 bytes).\n2026-05-29 06:44:53,031 [root] DEBUG: 11132: DLL loaded at 0x6CEF0000: C:\\Windows\\system32\\ncryptsslp (0x1f000 bytes).\n2026-05-29 06:44:53,033 [root] DEBUG: 11132: DLL loaded at 0x701B0000: C:\\Windows\\SYSTEM32\\MSASN1 (0xe000 bytes).\n2026-05-29 06:44:53,263 [root] DEBUG: 11132: DLL loaded at 0x6E2E0000: C:\\Windows\\SYSTEM32\\DPAPI (0x8000 bytes).\n2026-05-29 06:44:53,269 [root] INFO: Added new file to list with pid 11132 and path C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log\n2026-05-29 06:44:53,270 [root] DEBUG: 11132: NtTerminateProcess hook: Attempting to dump process 11132\n2026-05-29 06:44:53,271 [root] DEBUG: 11132: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:44:53,276 [root] INFO: Process with pid 11132 has terminated\n2026-05-29 06:44:53,285 [root] DEBUG: 5932: NtTerminateProcess hook: Attempting to dump process 5932\n2026-05-29 06:44:53,285 [root] DEBUG: 5932: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:44:53,293 [root] INFO: Process with pid 5932 has terminated\n2026-05-29 06:44:55,897 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 11408: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:44:55,899 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 11408\n2026-05-29 06:44:55,900 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 11408\n2026-05-29 06:45:20,815 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4C1E0000: C:\\Windows\\system32\\SecurityHealthProxyStub (0x1f000 bytes).\n2026-05-29 06:45:20,823 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 11836: C:\\Windows\\System32\\SecurityHealthHost.exe, ImageBase: 0x00007FF652CF0000\n2026-05-29 06:45:20,824 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11836\n2026-05-29 06:45:20,824 [lib.api.process] INFO: Monitor config for process 11836: C:\\lpw_albt\\dll\\11836.ini\n2026-05-29 06:45:20,826 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:20,828 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:20,835 [root] DEBUG: Loader: Injecting process 11836 (thread 11840) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:20,836 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:20,836 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:20,838 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:20,840 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11836\n2026-05-29 06:45:20,840 [lib.api.process] INFO: Monitor config for process 11836: C:\\lpw_albt\\dll\\11836.ini\n2026-05-29 06:45:20,840 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:20,842 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:20,846 [root] DEBUG: Loader: Injecting process 11836 (thread 11840) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:20,846 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:20,847 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:20,848 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:20,858 [root] DEBUG: 11836: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:45:20,859 [root] DEBUG: 11836: Interactive desktop enabled.\n2026-05-29 06:45:20,859 [root] DEBUG: 11836: Dropped file limit defaulting to 100.\n2026-05-29 06:45:20,862 [root] DEBUG: 11836: Disabling sleep skipping.\n2026-05-29 06:45:20,864 [root] DEBUG: 11836: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:45:20,876 [root] DEBUG: 11836: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:45:20,876 [root] DEBUG: 11836: YaraScan: Scanning 0x00007FF652CF0000, size 0x19174\n2026-05-29 06:45:20,877 [root] DEBUG: 11836: Monitor initialised: 64-bit capemon loaded in process 11836 at 0x00007FFF18240000, thread 11840, image base 0x00007FF652CF0000, stack from 0x000000E02A964000-0x000000E02A970000\n2026-05-29 06:45:20,878 [root] DEBUG: 11836: Commandline: C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding\n2026-05-29 06:45:20,890 [root] DEBUG: 11836: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-29 06:45:20,913 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-29 06:45:20,914 [root] DEBUG: 11836: set_hooks: Unable to hook LockResource\n2026-05-29 06:45:20,920 [root] DEBUG: 11836: Hooked 627 out of 628 functions\n2026-05-29 06:45:20,922 [root] DEBUG: 11836: Syscall hook installed, syscall logging level 1\n2026-05-29 06:45:20,933 [root] DEBUG: 11836: RestoreHeaders: Restored original import table.\n2026-05-29 06:45:20,933 [root] INFO: Loaded monitor into process with pid 11836\n2026-05-29 06:45:20,934 [root] DEBUG: 11836: caller_dispatch: Added region at 0x00007FF652CF0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF652CFD3B2, thread 11840).\n2026-05-29 06:45:20,935 [root] DEBUG: 11836: YaraScan: Scanning 0x00007FF652CF0000, size 0x19174\n2026-05-29 06:45:20,937 [root] DEBUG: 11836: ProcessImageBase: Main module image at 0x00007FF652CF0000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:45:20,940 [root] DEBUG: 11836: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 06:45:20,941 [root] DEBUG: 11836: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-29 06:45:20,943 [root] DEBUG: 11836: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 06:45:20,961 [root] DEBUG: 11836: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\system32\\Wldp (0x2d000 bytes).\n2026-05-29 06:45:20,962 [root] DEBUG: 11836: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:20,962 [root] DEBUG: 11836: DLL loaded at 0x00007FFF18110000: C:\\Windows\\system32\\SecurityHealthAgent (0x6d000 bytes).\n2026-05-29 06:45:20,977 [root] DEBUG: 11836: DLL loaded at 0x00007FFF4C1E0000: C:\\Windows\\system32\\SecurityHealthProxyStub (0x1f000 bytes).\n2026-05-29 06:45:20,984 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52B60000: C:\\Windows\\System32\\msxml6 (0x25f000 bytes).\n2026-05-29 06:45:20,995 [root] DEBUG: 11836: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:45:20,996 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-29 06:45:20,997 [root] DEBUG: 11836: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-29 06:45:20,998 [root] DEBUG: 11836: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:20,999 [root] DEBUG: 11836: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-29 06:45:20,999 [root] DEBUG: 11836: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-29 06:45:21,008 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-29 06:45:21,019 [root] DEBUG: 11836: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-29 06:45:21,031 [root] DEBUG: 11836: DLL loaded at 0x00007FFF3FD40000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-29 06:45:21,064 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE131000, size: 0x1000.\n2026-05-29 06:45:21,065 [root] DEBUG: 11836: NtTerminateProcess hook: Attempting to dump process 11836\n2026-05-29 06:45:21,066 [root] DEBUG: 11836: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:45:21,072 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE121000, size: 0x1000.\n2026-05-29 06:45:21,078 [root] INFO: Process with pid 11836 has terminated\n2026-05-29 06:45:21,079 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE130000.\n2026-05-29 06:45:21,129 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 12232: C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe, ImageBase: 0x00007FF65DCB0000\n2026-05-29 06:45:21,130 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232\n2026-05-29 06:45:21,131 [lib.api.process] INFO: Monitor config for process 12232: C:\\lpw_albt\\dll\\12232.ini\n2026-05-29 06:45:21,133 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:21,857 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:21,862 [root] DEBUG: Loader: Injecting process 12232 (thread 12236) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:21,863 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:21,864 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:21,865 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:21,867 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232\n2026-05-29 06:45:21,867 [lib.api.process] INFO: Monitor config for process 12232: C:\\lpw_albt\\dll\\12232.ini\n2026-05-29 06:45:21,868 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,234 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 10244: C:\\Windows\\system32\\sppsvc.exe, ImageBase: 0x0000000000000000\n2026-05-29 06:45:22,235 [lib.api.process] WARNING: OpenThread(THREAD_ALL_ACCESS, ...) failed for thread 10272\n2026-05-29 06:45:22,235 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244\n2026-05-29 06:45:22,236 [lib.api.process] INFO: Monitor config for process 10244: C:\\lpw_albt\\dll\\10244.ini\n2026-05-29 06:45:22,237 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,240 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,245 [root] DEBUG: Loader: Injecting process 10244 (thread 10272) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,247 [root] DEBUG: Loader: Copied config file C:\\lpw_albt\\dll\\10244.ini to system path C:\\10244.ini\n2026-05-29 06:45:22,248 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\\lpw_albt\\dll\\yCvZHFYF.dll\n2026-05-29 06:45:22,249 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,251 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,252 [lib.api.process] WARNING: OpenThread(THREAD_ALL_ACCESS, ...) failed for thread 10272\n2026-05-29 06:45:22,252 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244\n2026-05-29 06:45:22,253 [lib.api.process] INFO: Monitor config for process 10244: C:\\lpw_albt\\dll\\10244.ini\n2026-05-29 06:45:22,254 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,257 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,262 [root] DEBUG: Loader: Injecting process 10244 (thread 10272) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,264 [root] DEBUG: Loader: Copied config file C:\\lpw_albt\\dll\\10244.ini to system path C:\\10244.ini\n2026-05-29 06:45:22,266 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\\lpw_albt\\dll\\yCvZHFYF.dll\n2026-05-29 06:45:22,267 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,268 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,270 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244\n2026-05-29 06:45:22,270 [lib.api.process] INFO: Monitor config for process 10244: C:\\lpw_albt\\dll\\10244.ini\n2026-05-29 06:45:22,271 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,274 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,281 [root] DEBUG: Loader: Injecting process 10244 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,282 [root] DEBUG: Loader: Copied config file C:\\lpw_albt\\dll\\10244.ini to system path C:\\10244.ini\n2026-05-29 06:45:22,284 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\\lpw_albt\\dll\\yCvZHFYF.dll\n2026-05-29 06:45:22,285 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,286 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,294 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 9388: C:\\Windows\\System32\\svchost.exe, ImageBase: 0x00007FF7BF220000\n2026-05-29 06:45:22,295 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388\n2026-05-29 06:45:22,295 [lib.api.process] INFO: Monitor config for process 9388: C:\\lpw_albt\\dll\\9388.ini\n2026-05-29 06:45:22,296 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,300 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,305 [root] DEBUG: Loader: Injecting process 9388 (thread 9348) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,306 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:22,307 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,310 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,312 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388\n2026-05-29 06:45:22,312 [lib.api.process] INFO: Monitor config for process 9388: C:\\lpw_albt\\dll\\9388.ini\n2026-05-29 06:45:22,313 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,317 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,324 [root] DEBUG: Loader: Injecting process 9388 (thread 9348) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,325 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:22,326 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,328 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,329 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388\n2026-05-29 06:45:22,330 [lib.api.process] INFO: Monitor config for process 9388: C:\\lpw_albt\\dll\\9388.ini\n2026-05-29 06:45:22,331 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,335 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,340 [root] DEBUG: Loader: Injecting process 9388 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,341 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 9348, handle 0x120\n2026-05-29 06:45:22,341 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:22,342 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,344 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,352 [root] DEBUG: 9388: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:45:22,353 [root] DEBUG: 9388: Interactive desktop enabled.\n2026-05-29 06:45:22,355 [root] DEBUG: 9388: Dropped file limit defaulting to 100.\n2026-05-29 06:45:22,355 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56140000: C:\\Windows\\SYSTEM32\\sppc (0x25000 bytes).\n2026-05-29 06:45:22,356 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56170000: C:\\Windows\\system32\\slc (0x29000 bytes).\n2026-05-29 06:45:22,358 [root] DEBUG: 9388: Disabling sleep skipping.\n2026-05-29 06:45:22,359 [root] DEBUG: 4104: DLL loaded at 0x00007FFF17400000: C:\\Windows\\system32\\slwga (0x19000 bytes).\n2026-05-29 06:45:22,360 [root] DEBUG: 9388: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:45:22,373 [root] DEBUG: 9388: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:45:22,374 [root] DEBUG: 9388: YaraScan: Scanning 0x00007FF7BF220000, size 0xf06a\n2026-05-29 06:45:22,375 [root] DEBUG: 9388: Monitor initialised: 64-bit capemon loaded in process 9388 at 0x00007FFF18240000, thread 9348, image base 0x00007FF7BF220000, stack from 0x000000EA5B274000-0x000000EA5B280000\n2026-05-29 06:45:22,376 [root] DEBUG: 9388: Commandline: C:\\Windows\\System32\\svchost.exe -k WerSvcGroup\n2026-05-29 06:45:22,387 [root] DEBUG: 4104: DLL loaded at 0x00007FFF17220000: C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).\n2026-05-29 06:45:22,388 [root] DEBUG: 9388: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-29 06:45:22,410 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-29 06:45:22,411 [root] DEBUG: 9388: set_hooks: Unable to hook LockResource\n2026-05-29 06:45:22,415 [root] DEBUG: 9388: Hooked 627 out of 628 functions\n2026-05-29 06:45:22,417 [root] DEBUG: 9388: Syscall hook installed, syscall logging level 1\n2026-05-29 06:45:22,421 [root] DEBUG: 9388: RestoreHeaders: Restored original import table.\n2026-05-29 06:45:22,422 [root] INFO: Loaded monitor into process with pid 9388\n2026-05-29 06:45:22,423 [root] DEBUG: 9388: caller_dispatch: Added region at 0x00007FF7BF220000 to tracked regions list (kernel32::GetCommandLineW returns to 0x00007FF7BF2250EA, thread 9348).\n2026-05-29 06:45:22,423 [root] DEBUG: 9388: YaraScan: Scanning 0x00007FF7BF220000, size 0xf06a\n2026-05-29 06:45:22,424 [root] DEBUG: 9388: ProcessImageBase: Main module image at 0x00007FF7BF220000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:45:22,433 [root] DEBUG: 9388: DLL loaded at 0x00007FFF523E0000: c:\\windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:22,434 [root] DEBUG: 9388: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:45:22,435 [root] DEBUG: 9388: DLL loaded at 0x00007FFF3E0F0000: c:\\windows\\system32\\WindowsPerformanceRecorderControl (0x12d000 bytes).\n2026-05-29 06:45:22,436 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1196: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:45:22,436 [root] DEBUG: 9388: DLL loaded at 0x00007FFF17190000: c:\\windows\\system32\\WerEtw (0x3f000 bytes).\n2026-05-29 06:45:22,437 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1196\n2026-05-29 06:45:22,438 [root] DEBUG: 9388: DLL loaded at 0x00007FFF171D0000: c:\\windows\\system32\\wersvc (0x45000 bytes).\n2026-05-29 06:45:22,438 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1196\n2026-05-29 06:45:22,442 [root] DEBUG: 9388: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\SYSTEM32\\WLDP (0x2d000 bytes).\n2026-05-29 06:45:22,447 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55330000: C:\\Windows\\System32\\wer (0xde000 bytes).\n2026-05-29 06:45:22,455 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,456 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,461 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,462 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,466 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,467 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,479 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-29 06:45:22,488 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,489 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,494 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,494 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:22,495 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,499 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,500 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,500 [root] DEBUG: Loader: Injecting process 12232 (thread 12236) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,501 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:22,502 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:22,505 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:22,506 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232\n2026-05-29 06:45:22,506 [lib.api.process] INFO: Monitor config for process 12232: C:\\lpw_albt\\dll\\12232.ini\n2026-05-29 06:45:22,507 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:22,512 [root] DEBUG: 9388: OpenProcessHandler: Injection info created for process 8756, handle 0x2a4: C:\\lpw_albt\\bin\\PPLinject64.exe\n2026-05-29 06:45:22,513 [root] DEBUG: 9388: OpenProcessHandler: Image base for process 8756 (handle 0x2a4): 0x00007FF68CAE0000.\n2026-05-29 06:45:22,517 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-29 06:45:22,519 [root] DEBUG: 9388: CreateProcessHandler: Injection info set for new process 2104: C:\\Windows\\system32\\WerFault.exe, ImageBase: 0x00007FF78EB10000\n2026-05-29 06:45:22,520 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 2104\n2026-05-29 06:45:22,525 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 2104\n2026-05-29 06:45:22,609 [root] DEBUG: 9388: DLL loaded at 0x00007FFF47530000: c:\\windows\\system32\\dbghelp (0x1e4000 bytes).\n2026-05-29 06:45:22,610 [root] DEBUG: 9388: DLL loaded at 0x00007FFF474F0000: c:\\windows\\system32\\dbgcore (0x34000 bytes).\n2026-05-29 06:45:22,611 [root] DEBUG: 9388: DLL loaded at 0x00007FFF46350000: c:\\windows\\system32\\faultrep (0x7b000 bytes).\n2026-05-29 06:45:22,615 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55330000: c:\\windows\\system32\\wer (0xde000 bytes).\n2026-05-29 06:45:22,622 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,623 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,630 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,631 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,634 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,636 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,641 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFBAE0000: C:\\Windows\\System32\\CloudExperienceHostCommon (0x128000 bytes).\n2026-05-29 06:45:22,652 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,653 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,658 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,658 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,663 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,664 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,677 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57520000: c:\\windows\\system32\\USERENV (0x2e000 bytes).\n2026-05-29 06:45:22,679 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57560000: c:\\windows\\system32\\profapi (0x25000 bytes).\n2026-05-29 06:45:22,690 [root] DEBUG: 9388: CreateProcessHandler: Injection info set for new process 7024: C:\\Windows\\system32\\WerFault.exe, ImageBase: 0x00007FF78EB10000\n2026-05-29 06:45:22,692 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 7024\n2026-05-29 06:45:22,694 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 7024\n2026-05-29 06:45:22,880 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,881 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,884 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,885 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,888 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,889 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,897 [root] INFO: Error dumping file from path \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp\": [Errno 13] Permission denied: 'C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\WER\\\\Temp\\\\WERC3DE.tmp'\n2026-05-29 06:45:22,898 [root] INFO: Error dumping file from path \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp\": [Errno 13] Permission denied: 'C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\WER\\\\Temp\\\\WERC3DE.tmp'\n2026-05-29 06:45:22,918 [root] DEBUG: 9388: api-rate-cap: NtWriteFile hook disabled due to rate\n2026-05-29 06:45:22,936 [root] INFO: Added new file to list with pid 9388 and path C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp.csv\n2026-05-29 06:45:22,942 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,943 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,947 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,948 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,953 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:22,954 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:22,961 [root] INFO: Error dumping file from path \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp\": [Errno 13] Permission denied: 'C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\WER\\\\Temp\\\\WERC41D.tmp'\n2026-05-29 06:45:22,963 [root] INFO: Error dumping file from path \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp\": [Errno 13] Permission denied: 'C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\WER\\\\Temp\\\\WERC41D.tmp'\n2026-05-29 06:45:22,968 [root] INFO: Added new file to list with pid 9388 and path C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp.txt\n2026-05-29 06:45:23,086 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:23,092 [root] DEBUG: Loader: Injecting process 12232 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:23,093 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 12236, handle 0x120\n2026-05-29 06:45:23,094 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:23,094 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:23,096 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:42,448 [root] INFO: Announced starting service \"b'wisvc'\"\n2026-05-29 06:45:43,465 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 12224: C:\\Windows\\system32\\svchost.exe, ImageBase: 0x00007FF7BF220000\n2026-05-29 06:45:43,466 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224\n2026-05-29 06:45:43,467 [lib.api.process] INFO: Monitor config for process 12224: C:\\lpw_albt\\dll\\12224.ini\n2026-05-29 06:45:43,468 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:43,471 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:43,476 [root] DEBUG: Loader: Injecting process 12224 (thread 12228) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,477 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:43,478 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,479 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:43,481 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224\n2026-05-29 06:45:43,481 [lib.api.process] INFO: Monitor config for process 12224: C:\\lpw_albt\\dll\\12224.ini\n2026-05-29 06:45:43,482 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:43,485 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:43,489 [root] DEBUG: Loader: Injecting process 12224 (thread 12228) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,490 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:43,491 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,492 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:43,493 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224\n2026-05-29 06:45:43,494 [lib.api.process] INFO: Monitor config for process 12224: C:\\lpw_albt\\dll\\12224.ini\n2026-05-29 06:45:43,495 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:43,499 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:43,503 [root] DEBUG: Loader: Injecting process 12224 with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,504 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 12228, handle 0x120\n2026-05-29 06:45:43,505 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-29 06:45:43,505 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:43,507 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:43,520 [root] DEBUG: 12224: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:45:43,521 [root] DEBUG: 12224: Interactive desktop enabled.\n2026-05-29 06:45:43,522 [root] DEBUG: 12224: Dropped file limit defaulting to 100.\n2026-05-29 06:45:43,522 [root] DEBUG: 12224: Disabling sleep skipping.\n2026-05-29 06:45:43,523 [root] DEBUG: 12224: Services hook set enabled\n2026-05-29 06:45:43,526 [root] DEBUG: 12224: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:45:43,537 [root] DEBUG: 12224: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:45:43,538 [root] DEBUG: 12224: Monitor initialised: 64-bit capemon loaded in process 12224 at 0x00007FFF18240000, thread 12228, image base 0x00007FF7BF220000, stack from 0x00000081BD184000-0x00000081BD190000\n2026-05-29 06:45:43,539 [root] DEBUG: 12224: Commandline: C:\\Windows\\system32\\svchost.exe -k netsvcs -p\n2026-05-29 06:45:43,555 [root] DEBUG: 12224: Hooked 69 out of 69 functions\n2026-05-29 06:45:43,557 [root] DEBUG: 12224: RestoreHeaders: Restored original import table.\n2026-05-29 06:45:43,558 [root] INFO: Loaded monitor into process with pid 12224\n2026-05-29 06:45:43,559 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 06:45:43,560 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-29 06:45:43,561 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 06:45:43,564 [root] DEBUG: 12224: DLL loaded at 0x00007FFF40A10000: c:\\windows\\system32\\flightsettings (0xe6000 bytes).\n2026-05-29 06:45:43,564 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\SYSTEM32\\WLDP (0x2d000 bytes).\n2026-05-29 06:45:43,568 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52B00000: C:\\Windows\\SYSTEM32\\wtsapi32 (0x14000 bytes).\n2026-05-29 06:45:43,570 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57360000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-29 06:45:43,571 [root] DEBUG: 12224: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-29 06:45:43,573 [root] DEBUG: 12224: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-29 06:45:43,576 [root] DEBUG: 12224: DLL loaded at 0x00007FFF566C0000: c:\\windows\\system32\\msvcp110_win (0x8a000 bytes).\n2026-05-29 06:45:43,576 [root] DEBUG: 12224: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-29 06:45:43,578 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-29 06:45:43,578 [root] DEBUG: 12224: DLL loaded at 0x00007FFF188A0000: C:\\Windows\\System32\\wosc (0x4e000 bytes).\n2026-05-29 06:45:43,585 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:45:43,585 [root] DEBUG: 12224: DLL loaded at 0x00007FFF42490000: C:\\Windows\\System32\\Windows.Networking.Connectivity (0xb9000 bytes).\n2026-05-29 06:45:43,587 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4F560000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-29 06:45:43,590 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\System32\\WinTypes (0x155000 bytes).\n2026-05-29 06:45:43,591 [root] DEBUG: 12224: DLL loaded at 0x00007FFF569F0000: C:\\Windows\\System32\\IPHLPAPI (0x3b000 bytes).\n2026-05-29 06:45:43,592 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58B20000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-29 06:45:43,594 [root] DEBUG: 12224: DLL loaded at 0x00007FFF40900000: C:\\Windows\\System32\\dusmapi (0x11000 bytes).\n2026-05-29 06:45:43,596 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57560000: C:\\Windows\\System32\\profapi (0x25000 bytes).\n2026-05-29 06:45:43,596 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4F590000: C:\\Windows\\System32\\Cabinet (0x29000 bytes).\n2026-05-29 06:45:43,597 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57520000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-05-29 06:45:43,597 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57AA0000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-29 06:45:43,598 [root] DEBUG: 12224: DLL loaded at 0x00007FFF3EE40000: C:\\Windows\\System32\\UpdatePolicy (0x43000 bytes).\n2026-05-29 06:45:43,599 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57130000: C:\\Windows\\System32\\MSASN1 (0x12000 bytes).\n2026-05-29 06:45:43,601 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D6A0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-29 06:45:43,601 [root] DEBUG: 12224: DLL loaded at 0x00007FFF47980000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-29 06:45:43,617 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,617 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,619 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,620 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,620 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,621 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,622 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,623 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,627 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:43,630 [root] DEBUG: 12224: DLL loaded at 0x00007FFF3E220000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-29 06:45:43,637 [root] DEBUG: 12224: DLL loaded at 0x00007FFF42C10000: C:\\Windows\\system32\\fcon (0x45000 bytes).\n2026-05-29 06:45:43,642 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56630000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-29 06:45:43,660 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,661 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,662 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,663 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,664 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,665 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,665 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,667 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,669 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:43,670 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:43,675 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:43,675 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:43,676 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:43,677 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:43,677 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:43,678 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:43,679 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:43,680 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:43,681 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:43,682 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:43,718 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,719 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,722 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,722 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,723 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,724 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,725 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,726 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,728 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:43,756 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,758 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,760 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,761 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,762 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,763 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,764 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,766 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,769 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:43,770 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:43,772 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:43,774 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:43,774 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:43,775 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:43,777 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:43,778 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:43,779 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:43,780 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:43,781 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:43,781 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:43,808 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,809 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,812 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,813 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,814 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,814 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,815 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,816 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,817 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:43,841 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,842 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,843 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,844 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,845 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,845 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,846 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,846 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,848 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:43,849 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:43,852 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:43,852 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:43,853 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:43,854 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:43,855 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:43,856 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:43,856 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:43,857 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:43,858 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:43,859 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:43,887 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,888 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,890 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,891 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,891 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,892 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,893 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,893 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,895 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:43,922 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,922 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,924 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,924 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,925 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,926 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,927 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,927 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,929 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:43,930 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:43,933 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:43,934 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:43,934 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:43,935 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:43,936 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:43,937 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:43,937 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:43,938 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:43,938 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:43,939 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:43,962 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,963 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,965 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,966 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,966 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,967 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,968 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,969 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:43,970 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:43,992 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:43,992 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:43,994 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:43,995 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:43,996 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:43,996 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:43,997 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:43,998 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,000 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,000 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,003 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,004 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,005 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,006 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,006 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,007 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,008 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,010 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,012 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,013 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:44,080 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,081 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,083 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,085 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,086 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,087 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,087 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,089 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,090 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:44,112 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,113 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,114 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,115 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,115 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,116 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,117 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,117 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,119 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,120 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,123 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,124 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,124 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,125 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,126 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,126 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,127 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,127 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,128 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,129 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:44,152 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,153 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,155 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,156 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,157 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,157 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,158 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,159 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,160 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:44,182 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,183 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,184 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,185 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,186 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,187 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,187 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,188 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,190 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,190 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,193 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,193 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,194 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,195 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,196 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,197 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,198 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,199 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,200 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,202 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:44,226 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,227 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,229 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,231 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,233 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,233 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,234 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,235 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,237 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:44,260 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,261 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,263 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,264 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,264 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,265 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,266 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,266 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,268 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,269 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,272 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,273 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,274 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,275 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,276 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,277 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,278 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,279 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,280 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,280 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:44,303 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,304 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,306 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,306 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,308 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,309 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,310 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,310 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,311 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:44,333 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,333 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,335 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,335 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,336 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,337 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,337 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,339 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,341 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,341 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,344 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,344 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,345 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,346 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,346 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,347 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,348 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,348 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,349 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,351 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:44,380 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,381 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,383 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,384 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,384 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,385 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,386 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,387 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,388 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\\Windows\\SYSTEM32\\AEPIC (0x92000 bytes).\n2026-05-29 06:45:44,408 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-29 06:45:44,409 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\\Windows\\system32\\utcutil (0x1f000 bytes).\n2026-05-29 06:45:44,411 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-29 06:45:44,412 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-29 06:45:44,412 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-29 06:45:44,413 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-29 06:45:44,414 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\\Windows\\system32\\dcntel (0xbf000 bytes).\n2026-05-29 06:45:44,414 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-29 06:45:44,417 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-29 06:45:44,417 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\Tbs (0x1b000 bytes).\n2026-05-29 06:45:44,420 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\\Windows\\system32\\WDSCORE (0x43000 bytes).\n2026-05-29 06:45:44,421 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\\Windows\\system32\\MSI (0x337000 bytes).\n2026-05-29 06:45:44,421 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\\Windows\\system32\\NETAPI32 (0x19000 bytes).\n2026-05-29 06:45:44,422 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-29 06:45:44,422 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\\Windows\\system32\\VERSION (0xa000 bytes).\n2026-05-29 06:45:44,423 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\\Windows\\system32\\tdh (0x11b000 bytes).\n2026-05-29 06:45:44,424 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-29 06:45:44,424 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\setupapi (0x46e000 bytes).\n2026-05-29 06:45:44,425 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\\Windows\\system32\\SAMCLI (0x19000 bytes).\n2026-05-29 06:45:44,426 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\\Windows\\system32\\appraiser (0x212000 bytes).\n2026-05-29 06:45:48,832 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 13492: C:\\Windows\\system32\\DllHost.exe, ImageBase: 0x00007FF6706B0000\n2026-05-29 06:45:48,837 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 13492\n2026-05-29 06:45:48,838 [lib.api.process] INFO: Monitor config for process 13492: C:\\lpw_albt\\dll\\13492.ini\n2026-05-29 06:45:48,841 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:48,844 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:48,851 [root] DEBUG: Loader: Injecting process 13492 (thread 13496) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:48,853 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:48,858 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:48,860 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:48,861 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 13492\n2026-05-29 06:45:48,861 [lib.api.process] INFO: Monitor config for process 13492: C:\\lpw_albt\\dll\\13492.ini\n2026-05-29 06:45:48,862 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-29 06:45:48,865 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\yCvZHFYF.dll, loader C:\\lpw_albt\\bin\\ibkiRcbt.exe\n2026-05-29 06:45:48,870 [root] DEBUG: Loader: Injecting process 13492 (thread 13496) with C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:48,871 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-29 06:45:48,871 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\yCvZHFYF.dll.\n2026-05-29 06:45:48,873 [lib.api.process] INFO: Injected into 64-bit \n2026-05-29 06:45:48,881 [root] DEBUG: 13492: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-29 06:45:48,882 [root] DEBUG: 13492: Interactive desktop enabled.\n2026-05-29 06:45:48,882 [root] DEBUG: 13492: Dropped file limit defaulting to 100.\n2026-05-29 06:45:48,884 [root] DEBUG: 13492: Disabling sleep skipping.\n2026-05-29 06:45:48,886 [root] DEBUG: 13492: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-29 06:45:48,897 [root] DEBUG: 13492: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-29 06:45:48,898 [root] DEBUG: 13492: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026\n2026-05-29 06:45:48,899 [root] DEBUG: 13492: Monitor initialised: 64-bit capemon loaded in process 13492 at 0x00007FFF18240000, thread 13496, image base 0x00007FF6706B0000, stack from 0x00000099FF124000-0x00000099FF130000\n2026-05-29 06:45:48,900 [root] DEBUG: 13492: Commandline: C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\n2026-05-29 06:45:48,911 [root] DEBUG: 13492: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-29 06:45:48,933 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-29 06:45:48,934 [root] DEBUG: 13492: set_hooks: Unable to hook LockResource\n2026-05-29 06:45:48,938 [root] DEBUG: 13492: Hooked 627 out of 628 functions\n2026-05-29 06:45:48,940 [root] DEBUG: 13492: Syscall hook installed, syscall logging level 1\n2026-05-29 06:45:48,945 [root] DEBUG: 13492: RestoreHeaders: Restored original import table.\n2026-05-29 06:45:48,945 [root] INFO: Loaded monitor into process with pid 13492\n2026-05-29 06:45:48,946 [root] DEBUG: 13492: caller_dispatch: Added region at 0x00007FF6706B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6706B12F2, thread 13496).\n2026-05-29 06:45:48,947 [root] DEBUG: 13492: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026\n2026-05-29 06:45:48,949 [root] DEBUG: 13492: ProcessImageBase: Main module image at 0x00007FF6706B0000 unmodified (entropy change 0.000000e+00)\n2026-05-29 06:45:48,951 [root] DEBUG: 13492: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-29 06:45:48,952 [root] DEBUG: 13492: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-29 06:45:48,955 [root] DEBUG: 13492: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-29 06:45:48,968 [root] DEBUG: 13492: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-29 06:45:48,982 [root] DEBUG: 13492: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-29 06:45:48,982 [root] DEBUG: 13492: DLL loaded at 0x00007FFF432B0000: C:\\Windows\\System32\\thumbcache (0x66000 bytes).\n2026-05-29 06:45:48,988 [root] DEBUG: 13492: DLL loaded at 0x00007FFF52860000: C:\\Windows\\system32\\propsys (0xf6000 bytes).\n2026-05-29 06:45:54,043 [root] INFO: Process with pid 13492 has terminated\n2026-05-29 06:45:54,044 [root] DEBUG: 13492: NtTerminateProcess hook: Attempting to dump process 13492\n2026-05-29 06:45:54,045 [root] DEBUG: 13492: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:46:22,371 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 14232: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-29 06:46:22,372 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 14232\n2026-05-29 06:46:22,373 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 14232\n2026-05-29 06:46:44,435 [root] DEBUG: 12224: NtTerminateProcess hook: Attempting to dump process 12224\n2026-05-29 06:46:44,436 [root] DEBUG: 12224: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:46:44,438 [root] INFO: Process with pid 12224 has terminated\n2026-05-29 06:47:22,988 [root] INFO: Added new file to list with pid 9388 and path C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\a6e4fa08-0880-4e40-b09b-bb389c339c38\n2026-05-29 06:47:22,989 [root] DEBUG: 9388: NtTerminateProcess hook: Attempting to dump process 9388\n2026-05-29 06:47:22,990 [root] DEBUG: 9388: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:47:22,999 [root] INFO: Process with pid 9388 has terminated\n2026-05-29 06:47:42,838 [root] INFO: Analysis timeout hit, terminating analysis\n2026-05-29 06:47:42,839 [lib.api.process] INFO: Terminate event set for process 4104\n2026-05-29 06:47:42,840 [root] DEBUG: 4104: Terminate Event: Attempting to dump process 4104\n2026-05-29 06:47:42,844 [root] DEBUG: 4104: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:47:42,866 [lib.api.process] INFO: Termination confirmed for process 4104\n2026-05-29 06:47:42,867 [root] INFO: Terminate event set for process 4104\n2026-05-29 06:47:42,866 [root] DEBUG: 4104: Terminate Event: monitor shutdown complete for process 4104\n2026-05-29 06:47:42,868 [lib.api.process] INFO: Terminate event set for process 832\n2026-05-29 06:47:42,868 [root] DEBUG: 832: Terminate Event: Attempting to dump process 832\n2026-05-29 06:47:42,870 [root] DEBUG: 832: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:47:42,872 [lib.api.process] INFO: Termination confirmed for process 832\n2026-05-29 06:47:42,872 [root] INFO: Terminate event set for process 832\n2026-05-29 06:47:42,873 [root] DEBUG: 832: Terminate Event: monitor shutdown complete for process 832\n2026-05-29 06:47:42,874 [lib.api.process] INFO: Terminate event set for process 676\n2026-05-29 06:47:42,875 [root] DEBUG: 676: Terminate Event: Attempting to dump process 676\n2026-05-29 06:47:42,877 [root] DEBUG: 676: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-29 06:47:42,879 [lib.api.process] INFO: Termination confirmed for process 676\n2026-05-29 06:47:42,880 [root] INFO: Terminate event set for process 676\n2026-05-29 06:47:42,880 [root] DEBUG: 676: Terminate Event: monitor shutdown complete for process 676\n2026-05-29 06:47:42,880 [root] INFO: Created shutdown mutex\n2026-05-29 06:47:43,884 [root] INFO: Shutting down package\n2026-05-29 06:47:43,885 [root] INFO: Stopping auxiliary modules\n2026-05-29 06:47:43,886 [root] INFO: Stopping auxiliary module: Browser\n2026-05-29 06:47:43,886 [root] INFO: Stopping auxiliary module: Human\n2026-05-29 06:47:43,887 [root] INFO: Stopping auxiliary module: Screenshots\n2026-05-29 06:47:43,887 [root] INFO: Finishing auxiliary modules\n2026-05-29 06:47:43,887 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-05-29 06:47:43,896 [lib.common.results] INFO: Uploading file C:\\ProgramData\\Microsoft\\EdgeUpdate\\Log\\MicrosoftEdgeUpdate.log to files\\a9dce6cfa04718d830d0b771fec562178730bed2ef59c79fede912a7dd96fef7; Size is 692816; Max size: 100000000\n2026-05-29 06:47:43,900 [root] WARNING: File at path c:\\programdata\\microsoft\\windows\\wer\\temp\\werc3de.tmp.csv does not exist, skipping\n2026-05-29 06:47:43,901 [root] WARNING: File at path c:\\programdata\\microsoft\\windows\\wer\\temp\\werc41d.tmp.txt does not exist, skipping\n2026-05-29 06:47:43,901 [root] WARNING: File at path c:\\programdata\\microsoft\\windows\\wer\\temp\\a6e4fa08-0880-4e40-b09b-bb389c339c38 does not exist, skipping\n2026-05-29 06:47:43,901 [root] WARNING: Folder at path \"C:\\gZRInK\\debugger\" does not exist, skipping\n2026-05-29 06:47:43,902 [root] WARNING: Folder at path \"C:\\gZRInK\\tlsdump\" does not exist, skipping\n2026-05-29 06:47:44,062 [root] WARNING: Monitor injection attempted but failed for process 9528\n2026-05-29 06:47:44,062 [root] WARNING: Monitor injection attempted but failed for process 9452\n2026-05-29 06:47:44,063 [root] WARNING: Monitor injection attempted but failed for process 10160\n2026-05-29 06:47:44,063 [root] WARNING: Monitor injection attempted but failed for process 8272\n2026-05-29 06:47:44,064 [root] WARNING: Monitor injection attempted but failed for process 9120\n2026-05-29 06:47:44,064 [root] WARNING: Monitor injection attempted but failed for process 12232\n2026-05-29 06:47:44,065 [root] WARNING: Monitor injection attempted but failed for process 10244\n2026-05-29 06:47:44,065 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "81d26e094badab823539bbfd5b7cbc1e2b951cab5c1b8caefa3b21036d2783ca", "hosts": [ { "ip": "72.153.5.62", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "72.153.5.96", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "72.153.5.141", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.202.166.56", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "150.171.109.19", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "104.29.148.135", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.138.227", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.138.199", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50003 ] }, { "ip": "104.29.139.137", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50003 ] }, { "ip": "104.29.139.152", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50002 ] }, { "ip": "104.29.143.150", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.140.158", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50003 ] }, { "ip": "104.29.140.174", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50002 ] }, { "ip": "104.29.140.170", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.141.15", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50002 ] }, { "ip": "104.29.132.82", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.132.119", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.157.219", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.136.163", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50003 ] }, { "ip": "104.29.132.178", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.140.188", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.141.148", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.142.90", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50002 ] }, { "ip": "104.29.142.1", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.141.192", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50003 ] }, { "ip": "104.29.149.132", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50002 ] }, { "ip": "104.29.149.149", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50004 ] }, { "ip": "104.29.149.134", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.149.152", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "104.29.149.137", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 50001 ] }, { "ip": "162.159.130.235", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "latency.discord.media", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.211.129.205", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "146.75.119.82", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.211.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "shared.steamstatic.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.209.183.106", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "clientconfig.akamai.steamstatic.com", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "205.196.6.133", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "cmp2-sea1.steamserver.net", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.254.195.75", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "162.254.195.69", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.22", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "23.216.106.59", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "api.steampowered.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.56.110.169", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.128.235", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "latency.discord.media", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "185.247.139.200", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "badoomovies.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.136.232", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "status.discord.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.234", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "gateway-us-east1-c.discord.gg", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "discordapp.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.133.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "discordapp.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "142.250.195.227", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "c.pki.goog", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "40.126.14.161", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "104.115.81.8", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "172.172.255.218", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "149.135.84.155", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "steamconnecttest.com", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "199.232.215.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "shared.steamstatic.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.23", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] } ], "domains": [ { "domain": "api.steampowered.com", "ip": "23.216.106.59" }, { "domain": "ipv6check-udp.steamserver.net", "ip": "" }, { "domain": "ipv6check-http.steamserver.net", "ip": "" }, { "domain": "steamconnecttest.com", "ip": "23.56.110.24" }, { "domain": "c.pki.goog", "ip": "142.250.195.163" }, { "domain": "discordapp.com", "ip": "162.159.129.233" }, { "domain": "gateway-us-east1-c.discord.gg", "ip": "162.159.130.234" }, { "domain": "badoomovies.com", "ip": "185.247.139.200" }, { "domain": "status.discord.com", "ip": "162.159.136.232" }, { "domain": "cdn.discordapp.com", "ip": "162.159.133.233" }, { "domain": "updates.discord.com", "ip": "162.159.138.232" }, { "domain": "dns.google", "ip": "8.8.4.4" }, { "domain": "cmp2-sea1.steamserver.net", "ip": "205.196.6.133" }, { "domain": "p2p-syd1.discovery.steamserver.net", "ip": "103.10.125.42" }, { "domain": "clientconfig.akamai.steamstatic.com", "ip": "23.211.125.112" }, { "domain": "shared.steamstatic.com", "ip": "199.232.211.52" }, { "domain": "latency.discord.media", "ip": "162.159.137.234" }, { "domain": "disabled.invalid", "ip": "" } ], "tcp": [ { "src": "192.168.1.105", "sport": 49716, "dst": "103.10.125.23", "dport": 27018, "offset": 24, "time": 0.0 }, { "src": "192.168.1.105", "sport": 49729, "dst": "199.232.215.52", "dport": 443, "offset": 314, "time": 0.3367009162902832 }, { "src": "192.168.1.105", "sport": 49754, "dst": "149.135.84.155", "dport": 80, "offset": 1844, "time": 1.000040054321289 }, { "src": "192.168.1.105", "sport": 49732, "dst": "172.172.255.218", "dport": 443, "offset": 2739, "time": 1.2280731201171875 }, { "src": "192.168.1.105", "sport": 49734, "dst": "104.115.81.8", "dport": 443, "offset": 3546, "time": 1.2939460277557373 }, { "src": "192.168.1.105", "sport": 49757, "dst": "23.216.117.82", "dport": 80, "offset": 4864, "time": 1.3119289875030518 }, { "src": "192.168.1.105", "sport": 49680, "dst": "172.172.255.218", "dport": 443, "offset": 27728, "time": 1.62522292137146 }, { "src": "192.168.1.105", "sport": 49761, "dst": "104.115.81.8", "dport": 443, "offset": 29695, "time": 1.818850040435791 }, { "src": "192.168.1.105", "sport": 49762, "dst": "40.126.14.161", "dport": 443, "offset": 38537, "time": 1.8535289764404297 }, { "src": "192.168.1.105", "sport": 49760, "dst": "172.215.188.232", "dport": 443, "offset": 54208, "time": 1.9101231098175049 }, { "src": "192.168.1.105", "sport": 49765, "dst": "142.250.195.227", "dport": 80, "offset": 155379, "time": 2.2642440795898438 }, { "src": "192.168.1.105", "sport": 49766, "dst": "172.215.188.232", "dport": 443, "offset": 171844, "time": 2.460097074508667 }, { "src": "192.168.1.105", "sport": 49728, "dst": "162.159.133.233", "dport": 443, "offset": 178152, "time": 2.750926971435547 }, { "src": "192.168.1.105", "sport": 49769, "dst": "162.159.135.233", "dport": 443, "offset": 184750, "time": 2.8229780197143555 }, { "src": "192.168.1.105", "sport": 49772, "dst": "149.135.84.25", "dport": 80, "offset": 204132, "time": 3.4334449768066406 }, { "src": "192.168.1.105", "sport": 49773, "dst": "52.168.117.170", "dport": 443, "offset": 1929217, "time": 3.7590060234069824 }, { "src": "192.168.1.105", "sport": 49777, "dst": "23.100.109.78", "dport": 443, "offset": 2640912, "time": 4.466905117034912 }, { "src": "192.168.1.105", "sport": 49775, "dst": "20.42.179.204", "dport": 443, "offset": 2641748, "time": 4.473968029022217 }, { "src": "192.168.1.105", "sport": 49779, "dst": "52.168.117.170", "dport": 443, "offset": 2683867, "time": 6.826365947723389 }, { "src": "192.168.1.105", "sport": 49781, "dst": "20.42.179.204", "dport": 443, "offset": 2701826, "time": 7.8731091022491455 }, { "src": "192.168.1.105", "sport": 49702, "dst": "162.159.135.234", "dport": 443, "offset": 2712155, "time": 9.360421895980835 }, { "src": "192.168.1.105", "sport": 49784, "dst": "162.159.135.234", "dport": 443, "offset": 2721882, "time": 10.888505935668945 }, { "src": "192.168.1.105", "sport": 49787, "dst": "150.171.22.17", "dport": 443, "offset": 2762217, "time": 11.798557043075562 }, { "src": "192.168.1.105", "sport": 49788, "dst": "150.171.28.11", "dport": 443, "offset": 2774357, "time": 11.811880111694336 }, { "src": "192.168.1.105", "sport": 49790, "dst": "150.171.27.11", "dport": 443, "offset": 2814565, "time": 11.874995946884155 }, { "src": "192.168.1.105", "sport": 49794, "dst": "150.171.22.17", "dport": 443, "offset": 2869951, "time": 13.036304950714111 }, { "src": "192.168.1.105", "sport": 49796, "dst": "13.89.179.14", "dport": 443, "offset": 2906425, "time": 14.057068109512329 }, { "src": "192.168.1.105", "sport": 49797, "dst": "162.159.136.232", "dport": 443, "offset": 2917076, "time": 14.113599061965942 }, { "src": "192.168.1.105", "sport": 49731, "dst": "162.159.128.235", "dport": 443, "offset": 3030651, "time": 14.81129789352417 }, { "src": "192.168.1.105", "sport": 49801, "dst": "4.247.188.233", "dport": 443, "offset": 3040111, "time": 16.040627002716064 }, { "src": "192.168.1.105", "sport": 49805, "dst": "162.159.61.3", "dport": 443, "offset": 3081823, "time": 16.6636700630188 }, { "src": "192.168.1.105", "sport": 49803, "dst": "8.8.8.8", "dport": 443, "offset": 3109082, "time": 16.677077054977417 }, { "src": "192.168.1.105", "sport": 49807, "dst": "23.56.110.169", "dport": 443, "offset": 3134031, "time": 16.78028106689453 }, { "src": "192.168.1.105", "sport": 49809, "dst": "4.247.188.233", "dport": 443, "offset": 3180260, "time": 17.519251108169556 }, { "src": "192.168.1.105", "sport": 49811, "dst": "23.216.106.59", "dport": 443, "offset": 3213999, "time": 18.503187894821167 }, { "src": "192.168.1.105", "sport": 49813, "dst": "103.10.125.22", "dport": 27018, "offset": 3238585, "time": 18.80385994911194 }, { "src": "192.168.1.105", "sport": 49814, "dst": "103.10.125.23", "dport": 27018, "offset": 3239172, "time": 18.8038969039917 }, { "src": "192.168.1.105", "sport": 49812, "dst": "103.10.125.23", "dport": 443, "offset": 3239759, "time": 18.80716896057129 }, { "src": "192.168.1.105", "sport": 49815, "dst": "162.254.195.69", "dport": 443, "offset": 3256722, "time": 18.924601078033447 }, { "src": "192.168.1.105", "sport": 49817, "dst": "162.254.195.69", "dport": 27018, "offset": 3260960, "time": 19.112436056137085 }, { "src": "192.168.1.105", "sport": 49818, "dst": "162.254.195.75", "dport": 27018, "offset": 3261697, "time": 19.113837003707886 }, { "src": "192.168.1.105", "sport": 49819, "dst": "205.196.6.133", "dport": 443, "offset": 3262764, "time": 19.175031900405884 }, { "src": "192.168.1.105", "sport": 49822, "dst": "135.232.92.97", "dport": 443, "offset": 3352626, "time": 20.122467041015625 }, { "src": "192.168.1.105", "sport": 49826, "dst": "23.209.183.106", "dport": 80, "offset": 3379889, "time": 20.89143395423889 }, { "src": "192.168.1.105", "sport": 49828, "dst": "199.232.211.52", "dport": 443, "offset": 3383314, "time": 21.219027042388916 }, { "src": "192.168.1.105", "sport": 49829, "dst": "4.247.188.233", "dport": 443, "offset": 3469725, "time": 22.663639068603516 }, { "src": "192.168.1.105", "sport": 49832, "dst": "52.168.117.170", "dport": 443, "offset": 3499705, "time": 24.318268060684204 }, { "src": "192.168.1.105", "sport": 49753, "dst": "146.75.119.82", "dport": 443, "offset": 4145773, "time": 27.26737904548645 }, { "src": "192.168.1.105", "sport": 49836, "dst": "172.172.255.218", "dport": 443, "offset": 4218668, "time": 29.48715901374817 }, { "src": "192.168.1.105", "sport": 49835, "dst": "172.172.255.218", "dport": 443, "offset": 4219074, "time": 29.490987062454224 }, { "src": "192.168.1.105", "sport": 49842, "dst": "130.213.27.176", "dport": 443, "offset": 4327919, "time": 31.58149003982544 }, { "src": "192.168.1.105", "sport": 49707, "dst": "172.64.41.3", "dport": 443, "offset": 4336399, "time": 32.55079197883606 }, { "src": "192.168.1.105", "sport": 49705, "dst": "162.159.61.3", "dport": 443, "offset": 4336541, "time": 32.55092692375183 }, { "src": "192.168.1.105", "sport": 49710, "dst": "8.8.4.4", "dport": 443, "offset": 4337045, "time": 32.72099304199219 }, { "src": "192.168.1.105", "sport": 49844, "dst": "104.115.81.74", "dport": 80, "offset": 4443730, "time": 33.81119203567505 }, { "src": "192.168.1.105", "sport": 49724, "dst": "23.211.129.205", "dport": 443, "offset": 5126661, "time": 36.407737016677856 }, { "src": "192.168.1.105", "sport": 49726, "dst": "23.216.106.59", "dport": 443, "offset": 5126802, "time": 36.53307008743286 }, { "src": "192.168.1.105", "sport": 49725, "dst": "199.232.211.52", "dport": 443, "offset": 5137692, "time": 37.51764893531799 }, { "src": "192.168.1.105", "sport": 49727, "dst": "23.211.129.205", "dport": 443, "offset": 5139687, "time": 38.92787408828735 }, { "src": "192.168.1.105", "sport": 49851, "dst": "162.159.130.235", "dport": 443, "offset": 5150260, "time": 40.96838402748108 }, { "src": "192.168.1.105", "sport": 49853, "dst": "150.171.109.19", "dport": 443, "offset": 5193697, "time": 41.75156807899475 }, { "src": "192.168.1.105", "sport": 49856, "dst": "150.171.22.17", "dport": 443, "offset": 5258928, "time": 42.193357944488525 }, { "src": "192.168.1.105", "sport": 49858, "dst": "4.247.188.233", "dport": 443, "offset": 6049228, "time": 68.80860590934753 }, { "src": "192.168.1.105", "sport": 49864, "dst": "150.171.27.11", "dport": 443, "offset": 6062935, "time": 71.78683805465698 }, { "src": "192.168.1.105", "sport": 49866, "dst": "4.247.188.233", "dport": 443, "offset": 6109393, "time": 72.3096170425415 }, { "src": "192.168.1.105", "sport": 49868, "dst": "4.247.188.233", "dport": 443, "offset": 6133739, "time": 73.54052710533142 }, { "src": "192.168.1.105", "sport": 49869, "dst": "104.115.81.8", "dport": 443, "offset": 6139551, "time": 73.94814205169678 }, { "src": "192.168.1.105", "sport": 49871, "dst": "104.208.16.91", "dport": 443, "offset": 6154002, "time": 84.48164796829224 } ], "udp": [ { "src": "192.168.1.105", "sport": 61892, "dst": "8.8.8.8", "dport": 53, "offset": 567, "time": 0.4366610050201416 }, { "src": "192.168.1.105", "sport": 54460, "dst": "8.8.8.8", "dport": 53, "offset": 1160, "time": 0.8327488899230957 }, { "src": "192.168.1.105", "sport": 62345, "dst": "8.8.8.8", "dport": 53, "offset": 3010, "time": 1.274411916732788 }, { "src": "192.168.1.105", "sport": 61795, "dst": "8.8.8.8", "dport": 53, "offset": 28045, "time": 1.705967903137207 }, { "src": "192.168.1.105", "sport": 59163, "dst": "8.8.8.8", "dport": 53, "offset": 122635, "time": 2.1378390789031982 }, { "src": "192.168.1.105", "sport": 63703, "dst": "8.8.8.8", "dport": 53, "offset": 157050, "time": 2.293652057647705 }, { "src": "192.168.1.105", "sport": 64183, "dst": "8.8.8.8", "dport": 53, "offset": 179446, "time": 2.7720389366149902 }, { "src": "192.168.1.105", "sport": 49569, "dst": "8.8.8.8", "dport": 53, "offset": 862118, "time": 3.4965710639953613 }, { "src": "192.168.1.105", "sport": 138, "dst": "192.168.1.255", "dport": 138, "offset": 2479344, "time": 4.097584962844849 }, { "src": "192.168.1.105", "sport": 55111, "dst": "8.8.8.8", "dport": 53, "offset": 2639598, "time": 4.307337045669556 }, { "src": "192.168.1.105", "sport": 59982, "dst": "8.8.8.8", "dport": 53, "offset": 2721102, "time": 10.845593929290771 }, { "src": "192.168.1.105", "sport": 60076, "dst": "8.8.8.8", "dport": 53, "offset": 2728398, "time": 10.927962064743042 }, { "src": "192.168.1.105", "sport": 58178, "dst": "8.8.8.8", "dport": 53, "offset": 2753259, "time": 11.762545108795166 }, { "src": "192.168.1.105", "sport": 53014, "dst": "8.8.8.8", "dport": 53, "offset": 2753450, "time": 11.765676021575928 }, { "src": "192.168.1.105", "sport": 56373, "dst": "8.8.8.8", "dport": 53, "offset": 2753638, "time": 11.774456977844238 }, { "src": "192.168.1.105", "sport": 63884, "dst": "8.8.8.8", "dport": 53, "offset": 2760295, "time": 11.783447980880737 }, { "src": "192.168.1.105", "sport": 50825, "dst": "8.8.8.8", "dport": 53, "offset": 2776275, "time": 11.82548999786377 }, { "src": "192.168.1.105", "sport": 54436, "dst": "8.8.8.8", "dport": 53, "offset": 2789654, "time": 11.843498945236206 }, { "src": "192.168.1.105", "sport": 63067, "dst": "8.8.8.8", "dport": 53, "offset": 2837595, "time": 11.931754112243652 }, { "src": "192.168.1.105", "sport": 51810, "dst": "162.159.136.232", "dport": 443, "offset": 2838710, "time": 11.958466053009033 }, { "src": "192.168.1.105", "sport": 50912, "dst": "185.247.139.200", "dport": 443, "offset": 2860283, "time": 12.136462926864624 }, { "src": "192.168.1.105", "sport": 49408, "dst": "8.8.8.8", "dport": 53, "offset": 2864590, "time": 13.000269889831543 }, { "src": "192.168.1.105", "sport": 59162, "dst": "8.8.8.8", "dport": 53, "offset": 2907402, "time": 14.066520929336548 }, { "src": "192.168.1.105", "sport": 55135, "dst": "162.159.135.233", "dport": 443, "offset": 2909509, "time": 14.09295392036438 }, { "src": "192.168.1.105", "sport": 51981, "dst": "8.8.8.8", "dport": 53, "offset": 3049316, "time": 16.626986980438232 }, { "src": "192.168.1.105", "sport": 49635, "dst": "8.8.8.8", "dport": 53, "offset": 3049488, "time": 16.62739610671997 }, { "src": "192.168.1.105", "sport": 50242, "dst": "8.8.8.8", "dport": 53, "offset": 3049690, "time": 16.62771701812744 }, { "src": "192.168.1.105", "sport": 55397, "dst": "8.8.8.8", "dport": 53, "offset": 3049862, "time": 16.628014087677002 }, { "src": "192.168.1.105", "sport": 49421, "dst": "8.8.8.8", "dport": 53, "offset": 3050064, "time": 16.628323078155518 }, { "src": "192.168.1.105", "sport": 55195, "dst": "8.8.8.8", "dport": 53, "offset": 3050236, "time": 16.62861394882202 }, { "src": "192.168.1.105", "sport": 59213, "dst": "8.8.4.4", "dport": 443, "offset": 3051575, "time": 16.65126609802246 }, { "src": "192.168.1.105", "sport": 63747, "dst": "172.64.41.3", "dport": 443, "offset": 3057370, "time": 16.653762102127075 }, { "src": "192.168.1.105", "sport": 60122, "dst": "23.56.110.169", "dport": 443, "offset": 3120435, "time": 16.756664991378784 }, { "src": "192.168.1.105", "sport": 54702, "dst": "8.8.8.8", "dport": 53, "offset": 3212941, "time": 18.328666925430298 }, { "src": "192.168.1.105", "sport": 55901, "dst": "8.8.8.8", "dport": 443, "offset": 3272735, "time": 19.303672075271606 }, { "src": "192.168.1.105", "sport": 59085, "dst": "8.8.8.8", "dport": 53, "offset": 3347846, "time": 19.76820397377014 }, { "src": "192.168.1.105", "sport": 5353, "dst": "224.0.0.251", "dport": 5353, "offset": 3350237, "time": 20.06399393081665 }, { "src": "192.168.1.105", "sport": 51952, "dst": "8.8.8.8", "dport": 53, "offset": 3382729, "time": 21.15671706199646 }, { "src": "192.168.1.105", "sport": 59684, "dst": "8.8.8.8", "dport": 53, "offset": 3578731, "time": 25.1594500541687 }, { "src": "192.168.1.105", "sport": 60441, "dst": "23.56.110.169", "dport": 443, "offset": 4200150, "time": 29.01594090461731 }, { "src": "192.168.1.105", "sport": 65391, "dst": "8.8.8.8", "dport": 53, "offset": 5148619, "time": 40.40010905265808 }, { "src": "192.168.1.105", "sport": 54699, "dst": "8.8.8.8", "dport": 53, "offset": 5149525, "time": 40.90002799034119 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.149.137", "dport": 50001, "offset": 5157002, "time": 41.113150119781494 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.149.152", "dport": 50001, "offset": 5157068, "time": 41.11323809623718 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.149.134", "dport": 50001, "offset": 5157134, "time": 41.11327409744263 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.149.149", "dport": 50004, "offset": 5157200, "time": 41.113303899765015 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.149.132", "dport": 50002, "offset": 5157266, "time": 41.11333703994751 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.141.192", "dport": 50003, "offset": 5157332, "time": 41.11337208747864 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.142.1", "dport": 50004, "offset": 5157398, "time": 41.113399028778076 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.142.90", "dport": 50002, "offset": 5157464, "time": 41.113425970077515 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.141.148", "dport": 50004, "offset": 5157530, "time": 41.11345291137695 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.140.188", "dport": 50001, "offset": 5157596, "time": 41.11348104476929 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.132.178", "dport": 50004, "offset": 5157662, "time": 41.11351490020752 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.136.163", "dport": 50003, "offset": 5157728, "time": 41.11354088783264 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.157.219", "dport": 50004, "offset": 5157794, "time": 41.11356592178345 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.132.119", "dport": 50004, "offset": 5157860, "time": 41.11359190940857 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.132.82", "dport": 50001, "offset": 5157926, "time": 41.1136200428009 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.141.15", "dport": 50002, "offset": 5157992, "time": 41.11365103721619 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.140.170", "dport": 50001, "offset": 5158058, "time": 41.11368203163147 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.140.174", "dport": 50002, "offset": 5158124, "time": 41.113709926605225 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.140.158", "dport": 50003, "offset": 5158190, "time": 41.11373591423035 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.143.150", "dport": 50001, "offset": 5158256, "time": 41.1138129234314 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.139.152", "dport": 50002, "offset": 5158322, "time": 41.113852977752686 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.139.137", "dport": 50003, "offset": 5158388, "time": 41.113900899887085 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.138.199", "dport": 50003, "offset": 5158454, "time": 41.11392903327942 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.138.227", "dport": 50001, "offset": 5158520, "time": 41.113959074020386 }, { "src": "192.168.1.105", "sport": 54700, "dst": "104.29.148.135", "dport": 50004, "offset": 5158586, "time": 41.11398410797119 }, { "src": "192.168.1.105", "sport": 55884, "dst": "8.8.8.8", "dport": 53, "offset": 5189159, "time": 41.726243019104004 }, { "src": "192.168.1.105", "sport": 63025, "dst": "8.8.8.8", "dport": 53, "offset": 5224040, "time": 42.149126052856445 }, { "src": "192.168.1.105", "sport": 49892, "dst": "8.8.8.8", "dport": 53, "offset": 6048568, "time": 68.62468099594116 }, { "src": "192.168.1.105", "sport": 54858, "dst": "8.8.8.8", "dport": 53, "offset": 6152938, "time": 79.8251941204071 }, { "src": "192.168.1.105", "sport": 55810, "dst": "239.255.255.250", "dport": 1900, "offset": 6153622, "time": 84.4219400882721 }, { "src": "192.168.1.105", "sport": 63762, "dst": "8.8.8.8", "dport": 53, "offset": 6275775, "time": 139.87482810020447 }, { "src": "192.168.1.105", "sport": 50438, "dst": "8.8.8.8", "dport": 53, "offset": 6280452, "time": 160.8456039428711 }, { "src": "192.168.1.105", "sport": 56008, "dst": "1.1.1.1", "dport": 53, "offset": 6298383, "time": 173.57586002349854 }, { "src": "192.168.1.105", "sport": 52637, "dst": "8.8.8.8", "dport": 443, "offset": 6298835, "time": 173.59077906608582 }, { "src": "192.168.1.105", "sport": 62434, "dst": "1.1.1.1", "dport": 53, "offset": 6315361, "time": 173.74555206298828 }, { "src": "192.168.1.105", "sport": 64665, "dst": "8.8.8.8", "dport": 53, "offset": 6317680, "time": 199.89425206184387 }, { "src": "192.168.1.105", "sport": 64666, "dst": "239.255.255.250", "dport": 1900, "offset": 6317932, "time": 204.4428689479828 } ], "icmp": [], "http": [ { "count": 1, "host": "steamconnecttest.com", "port": 80, "data": "GET /204 HTTP/1.1\r\nCache-Control: no-cache\r\nHost: steamconnecttest.com\r\nAccept: text/html,*/*;q=0.9\r\naccept-encoding: gzip,identity,*;q=0\r\naccept-charset: ISO-8859-1,utf-8,*;q=0.7\r\nuser-agent: Valve/Steam HTTP Client 1.0\r\n\r\n", "uri": "http://steamconnecttest.com/204", "body": "", "path": "/204", "user-agent": "Valve/Steam HTTP Client 1.0", "version": "1.1", "method": "GET", "first_seen": 1780037054.151864 }, { "count": 1, "host": "c.pki.goog", "port": 80, "data": "GET /r/r1.crl HTTP/1.1\r\nCache-Control: max-age = 3000\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT\r\nUser-Agent: Microsoft-CryptoAPI/10.0\r\nHost: c.pki.goog\r\n\r\n", "uri": "http://c.pki.goog/r/r1.crl", "body": "", "path": "/r/r1.crl", "user-agent": "Microsoft-CryptoAPI/10.0", "version": "1.1", "method": "GET", "first_seen": 1780037055.416068 }, { "count": 1, "host": "clientconfig.akamai.steamstatic.com", "port": 80, "data": "GET /appinfo/1493710/sha/e132000fb7610fac14cbf48b01aaf7ec9276e7a4.txt.gz HTTP/1.1\r\nHost: clientconfig.akamai.steamstatic.com\r\nAccept: text/html,*/*;q=0.9\r\naccept-encoding: gzip,identity,*;q=0\r\naccept-charset: ISO-8859-1,utf-8,*;q=0.7\r\nuser-agent: Valve/Steam HTTP Client 1.0\r\n\r\n", "uri": "http://clientconfig.akamai.steamstatic.com/appinfo/1493710/sha/e132000fb7610fac14cbf48b01aaf7ec9276e7a4.txt.gz", "body": "", "path": "/appinfo/1493710/sha/e132000fb7610fac14cbf48b01aaf7ec9276e7a4.txt.gz", "user-agent": "Valve/Steam HTTP Client 1.0", "version": "1.1", "method": "GET", "first_seen": 1780037074.043258 } ], "dns": [ { "request": "api.steampowered.com", "type": "A", "answers": [ { "type": "A", "data": "23.216.106.59" } ], "first_seen": 1780037053.471757 }, { "request": "ipv6check-udp.steamserver.net", "type": "AAAA", "answers": [ { "type": "CNAME", "data": "udp.ipv6check.akadns.net" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d36" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d37" }, { "type": "AAAA", "data": "2404:3fc0:1:100::670a:7d06" }, { "type": "AAAA", "data": "2404:3fc0:1:100::42" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d38" }, { "type": "CNAME", "data": "syd.udp.ipv6check.akadns.net" }, { "type": "AAAA", "data": "2404:3fc0:1:100::670a:7d08" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d35" }, { "type": "AAAA", "data": "2404:3fc0:1:100::32" } ], "first_seen": 1780037053.588485 }, { "request": "ipv6check-http.steamserver.net", "type": "A", "answers": [ { "type": "CNAME", "data": "http.ipv6check.akadns.net" }, { "type": "CNAME", "data": "syd.http.ipv6check.akadns.net" } ], "first_seen": 1780037053.802063 }, { "request": "steamconnecttest.com", "type": "A", "answers": [ { "type": "A", "data": "149.135.84.155" }, { "type": "A", "data": "149.135.84.160" } ], "first_seen": 1780037053.984573 }, { "request": "c.pki.goog", "type": "A", "answers": [ { "type": "A", "data": "142.250.195.227" }, { "type": "CNAME", "data": "pki-goog.l.google.com" } ], "first_seen": 1780037055.365996 }, { "request": "discordapp.com", "type": "A", "answers": [ { "type": "A", "data": "162.159.135.233" }, { "type": "A", "data": "162.159.134.233" }, { "type": "A", "data": "162.159.133.233" }, { "type": "A", "data": "162.159.129.233" }, { "type": "A", "data": "162.159.130.233" } ], "first_seen": 1780037055.923724 }, { "request": "gateway-us-east1-c.discord.gg", "type": "A", "answers": [ { "type": "A", "data": "162.159.130.234" }, { "type": "A", "data": "162.159.134.234" }, { "type": "A", "data": "162.159.135.234" }, { "type": "A", "data": "162.159.133.234" }, { "type": "A", "data": "162.159.136.234" } ], "first_seen": 1780037063.997418 }, { "request": "badoomovies.com", "type": "A", "answers": [ { "type": "A", "data": "185.247.139.200" } ], "first_seen": 1780037064.926281 }, { "request": "status.discord.com", "type": "A", "answers": [ { "type": "A", "data": "162.159.128.233" }, { "type": "A", "data": "162.159.138.232" }, { "type": "A", "data": "162.159.137.232" }, { "type": "A", "data": "162.159.135.232" }, { "type": "A", "data": "162.159.136.232" } ], "first_seen": 1780037065.083578 }, { "request": "cdn.discordapp.com", "type": "A", "answers": [], "first_seen": 1780037067.218218 }, { "request": "updates.discord.com", "type": "A", "answers": [], "first_seen": 1780037067.220014 }, { "request": "dns.google", "type": "A", "answers": [ { "type": "A", "data": "8.8.4.4" }, { "type": "A", "data": "8.8.8.8" } ], "first_seen": 1780037069.778992 }, { "request": "cmp2-sea1.steamserver.net", "type": "A", "answers": [ { "type": "A", "data": "205.196.6.133" } ], "first_seen": 1780037072.075312 }, { "request": "p2p-syd1.discovery.steamserver.net", "type": "A", "answers": [ { "type": "A", "data": "103.10.125.24" }, { "type": "A", "data": "103.10.125.42" } ], "first_seen": 1780037072.920028 }, { "request": "clientconfig.akamai.steamstatic.com", "type": "A", "answers": [ { "type": "A", "data": "23.209.183.106" }, { "type": "A", "data": "23.209.183.176" } ], "first_seen": 1780037073.902716 }, { "request": "shared.steamstatic.com", "type": "A", "answers": [ { "type": "A", "data": "199.232.215.52" }, { "type": "A", "data": "199.232.211.52" }, { "type": "CNAME", "data": "shared.valve.map.fastly.net" } ], "first_seen": 1780037074.308541 }, { "request": "latency.discord.media", "type": "A", "answers": [ { "type": "A", "data": "162.159.130.235" }, { "type": "A", "data": "162.159.129.235" }, { "type": "A", "data": "162.159.138.234" }, { "type": "A", "data": "162.159.137.234" }, { "type": "A", "data": "162.159.128.235" } ], "first_seen": 1780037094.051542 }, { "request": "disabled.invalid", "type": "A", "answers": [ { "type": "NXDOMAIN", "data": "" } ], "first_seen": 1780037226.897269 } ], "smtp": [], "irc": [], "dead_hosts": [ [ "185.247.139.200", 443 ], [ "23.202.166.56", 443 ], [ "72.153.5.141", 443 ], [ "72.153.5.96", 443 ], [ "72.153.5.62", 443 ] ] }, "url": { "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n BADOOMOVIES.COM\nCreation Date:\n 2026-05-26 15:06:50\nUpdated Date:\n 2026-05-26 16:54:14\nExpiration Date:\n 2027-05-26 15:06:50\nEmail(s):\n abuse-tracker@hostinger.com\n\nRegistrar(s):\n HOSTINGER operations, UAB\nName Server(s):\n DNS23.HOSTWARE.COM.TR\n DNS24.HOSTWARE.COM.TR\nReferral URL(s):\n None", "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" } }, "target": { "category": "url" }, "url_analysis": { "url": "https://badoomovies.com/download/BadooMovies.exe" }, "procmemory": [], "signatures": [ { "name": "antivm_checks_available_memory", "description": "Checks available memory", "categories": [ "antivm" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 5261 }, { "type": "call", "pid": 5932, "cid": 5836 }, { "type": "call", "pid": 5932, "cid": 7354 }, { "type": "call", "pid": 5932, "cid": 8431 } ], "new_data": [], "alert": false, "families": [] }, { "name": "dead_connect", "description": "Attempts to connect to a dead IP:Port (2 unique times)", "categories": [ "network" ], "severity": 1, "weight": 0, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 6736 }, { "type": "call", "pid": 11132, "cid": 2191 }, { "IP": "150.171.22.17:443" }, { "IP": "74.178.76.44:443" } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_keyboard_layout", "description": "Queries the keyboard layout", "categories": [ "location_discovery" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 3361 }, { "type": "call", "pid": 13492, "cid": 831 } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_locale_api", "description": "Queries the computer locale (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 1472 } ], "new_data": [], "alert": false, "families": [] }, { "name": "accesses_public_folder", "description": "A file was accessed within the Public folder.", "categories": [ "generic" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "file": "C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk" }, { "file": "C:\\Users\\Public\\Desktop" }, { "file": "C:\\Users\\Public\\Desktop\\Steam.lnk" }, { "file": "C:\\Users\\Public\\" }, { "file": "C:\\Users\\Public\\Desktop\\Google Chrome.lnk" }, { "file": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "file": "C:\\Users\\Public\\Desktop\\" }, { "file": "C:\\Users\\Public\\desktop.ini" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antidebug_setunhandledexceptionfilter", "description": "SetUnhandledExceptionFilter detected (possible anti-debug)", "categories": [ "anti-debug" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "type": "call", "pid": 9656, "cid": 165 } ], "new_data": [], "alert": false, "families": [] }, { "name": "exec_crash", "description": "At least one process apparently crashed during execution", "categories": [ "execution" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 9388, "cid": 109 } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_timeout", "description": "Possible date expiration check, exits too soon after checking local time", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "process": "MicrosoftEdgeUpdate.exe, PID 5932" }, { "type": "call", "pid": 5932, "cid": 8849 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "new_data": [], "alert": false, "families": [] }, { "name": "privilege_elevation_check", "description": "Queries process token information to check for Administrator privileges or UAC elevation status", "categories": [ "discovery", "privilege_escalation" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 9656, "cid": 876 }, { "type": "call", "pid": 9656, "cid": 877 }, { "type": "call", "pid": 9656, "cid": 3544 }, { "type": "call", "pid": 9656, "cid": 3545 }, { "type": "call", "pid": 9656, "cid": 3869 }, { "type": "call", "pid": 9656, "cid": 3870 }, { "type": "call", "pid": 9656, "cid": 4164 }, { "type": "call", "pid": 9656, "cid": 4165 }, { "type": "call", "pid": 5932, "cid": 1622 }, { "type": "call", "pid": 5932, "cid": 1623 }, { "type": "call", "pid": 5932, "cid": 3316 }, { "type": "call", "pid": 5932, "cid": 3317 }, { "type": "call", "pid": 5932, "cid": 3699 }, { "type": "call", "pid": 5932, "cid": 3700 }, { "type": "call", "pid": 5932, "cid": 3752 }, { "type": "call", "pid": 5932, "cid": 3753 }, { "type": "call", "pid": 5932, "cid": 3863 }, { "type": "call", "pid": 5932, "cid": 3864 }, { "type": "call", "pid": 5932, "cid": 7704 }, { "type": "call", "pid": 13492, "cid": 66 }, { "type": "call", "pid": 13492, "cid": 67 }, { "type": "call", "pid": 13492, "cid": 163 }, { "type": "call", "pid": 13492, "cid": 164 } ], "new_data": [], "alert": false, "families": [] }, { "name": "query_fips_reconnaissance", "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software", "categories": [ "discovery", "c2" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 1571 }, { "type": "call", "pid": 5932, "cid": 1572 }, { "type": "call", "pid": 5932, "cid": 1575 }, { "type": "call", "pid": 5932, "cid": 1577 }, { "type": "call", "pid": 5932, "cid": 1578 }, { "type": "call", "pid": 11132, "cid": 980 }, { "type": "call", "pid": 11132, "cid": 981 }, { "type": "call", "pid": 11132, "cid": 984 }, { "type": "call", "pid": 11132, "cid": 986 }, { "type": "call", "pid": 11132, "cid": 987 }, { "type": "call", "pid": 11836, "cid": 59 }, { "type": "call", "pid": 11836, "cid": 60 }, { "type": "call", "pid": 11836, "cid": 63 }, { "type": "call", "pid": 11836, "cid": 65 }, { "type": "call", "pid": 11836, "cid": 66 }, { "type": "call", "pid": 9388, "cid": 521 }, { "type": "call", "pid": 9388, "cid": 522 }, { "type": "call", "pid": 9388, "cid": 525 }, { "type": "call", "pid": 9388, "cid": 527 }, { "type": "call", "pid": 9388, "cid": 528 }, { "type": "call", "pid": 13492, "cid": 46 }, { "type": "call", "pid": 13492, "cid": 47 }, { "type": "call", "pid": 13492, "cid": 50 }, { "type": "call", "pid": 13492, "cid": 52 }, { "type": "call", "pid": 13492, "cid": 53 }, { "behavioral_fips_reconnaissance": [ "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'" ] } ], "new_data": [], "alert": false, "families": [] }, { "name": "mountpoints_volume_discovery", "description": "Queries the mount points and then resolves volume paths to enumerate storage devices", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "type": "call", "pid": 9656, "cid": 3750 }, { "type": "call", "pid": 9656, "cid": 3755 }, { "type": "call", "pid": 9656, "cid": 3766 }, { "type": "call", "pid": 9656, "cid": 3788 }, { "type": "call", "pid": 9656, "cid": 3803 }, { "type": "call", "pid": 9656, "cid": 3814 }, { "type": "call", "pid": 9656, "cid": 3818 }, { "type": "call", "pid": 9656, "cid": 3827 }, { "type": "call", "pid": 5932, "cid": 3196 }, { "type": "call", "pid": 5932, "cid": 3199 }, { "type": "call", "pid": 5932, "cid": 3204 }, { "type": "call", "pid": 5932, "cid": 3263 }, { "type": "call", "pid": 5932, "cid": 3271 }, { "type": "call", "pid": 5932, "cid": 3276 }, { "type": "call", "pid": 5932, "cid": 3279 }, { "type": "call", "pid": 5932, "cid": 3838 }, { "type": "call", "pid": 5932, "cid": 3840 }, { "type": "call", "pid": 5932, "cid": 4404 }, { "type": "call", "pid": 5932, "cid": 4407 }, { "type": "call", "pid": 5932, "cid": 5528 }, { "type": "call", "pid": 5932, "cid": 5530 }, { "type": "call", "pid": 5932, "cid": 5589 }, { "type": "call", "pid": 5932, "cid": 5591 } ], "new_data": [], "alert": false, "families": [] }, { "name": "dllload_suspicious_directory", "description": "A DLL was loaded from a suspicious directory", "categories": [ "side loading" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 4104, "cid": 123 }, { "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking" }, { "type": "call", "pid": 4104, "cid": 124 }, { "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking" } ], "new_data": [], "alert": false, "families": [] }, { "name": "registers_vectored_exception_handler", "description": "Registers a vectored exception handler (VEH), possibly to hijack execution flow", "categories": [ "evasion", "execution", "injection" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 9656, "cid": 166 } ], "new_data": [], "alert": false, "families": [] }, { "name": "creates_suspended_process", "description": "Creates a process in a suspended state, likely for injection", "categories": [ "injection", "process hollowing" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 4104, "cid": 102 }, { "type": "call", "pid": 4104, "cid": 108 }, { "type": "call", "pid": 4104, "cid": 119 }, { "type": "call", "pid": 4104, "cid": 120 }, { "type": "call", "pid": 4104, "cid": 143 }, { "type": "call", "pid": 4104, "cid": 144 }, { "type": "call", "pid": 4104, "cid": 177 }, { "type": "call", "pid": 4104, "cid": 183 }, { "type": "call", "pid": 832, "cid": 142 }, { "type": "call", "pid": 832, "cid": 153 }, { "type": "call", "pid": 832, "cid": 168 }, { "type": "call", "pid": 832, "cid": 181 }, { "type": "call", "pid": 832, "cid": 212 }, { "type": "call", "pid": 676, "cid": 6 }, { "type": "call", "pid": 676, "cid": 29 }, { "type": "call", "pid": 676, "cid": 34 }, { "type": "call", "pid": 676, "cid": 44 } ], "new_data": [], "alert": false, "families": [] }, { "name": "resumethread_remote_process", "description": "Resumed a thread in another process", "categories": [ "injection", "unpacking" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "thread_resumed": "Process svchost.exe with process ID 832 resumed a thread in another process with the process ID 9452" }, { "type": "call", "pid": 832, "cid": 143 }, { "type": "call", "pid": 832, "cid": 213 }, { "thread_resumed": "Process services.exe with process ID 676 resumed a thread in another process with the process ID 5932" }, { "type": "call", "pid": 676, "cid": 7 }, { "type": "call", "pid": 676, "cid": 30 }, { "type": "call", "pid": 676, "cid": 35 }, { "type": "call", "pid": 676, "cid": 45 } ], "new_data": [], "alert": false, "families": [] }, { "name": "terminates_remote_process", "description": "Terminates another process", "categories": [ "persistence", "stealth" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 832, "cid": 157 }, { "process": "svchost.exe" }, { "type": "call", "pid": 832, "cid": 170 }, { "process": "svchost.exe" }, { "type": "call", "pid": 832, "cid": 183 }, { "process": "svchost.exe" } ], "new_data": [], "alert": false, "families": [] }, { "name": "discover_registry_mount_points", "description": "Queries registry mount points to identify historical or connected removable/network drives", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "new_data": [], "alert": false, "families": [] }, { "name": "suspicious_tld", "description": "Resolves a suspicious Top Level Domain (TLD)", "categories": [ "network" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "domain": "latency.discord.media" } ], "new_data": [], "alert": false, "families": [] }, { "name": "uses_windows_utilities", "description": "Uses Windows utilities for basic functionality", "categories": [ "command", "lateral" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "command": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antisandbox_unhook", "description": "Tries to unhook or modify Windows functions monitored by CAPE", "categories": [ "anti-sandbox" ], "severity": 3, "weight": 1, "confidence": 60, "references": [], "data": [ { "type": "call", "pid": 9656, "cid": 2220 }, { "type": "call", "pid": 5932, "cid": 2112 }, { "type": "call", "pid": 5932, "cid": 2113 }, { "type": "call", "pid": 5932, "cid": 2114 }, { "type": "call", "pid": 5932, "cid": 2115 }, { "type": "call", "pid": 5932, "cid": 2116 }, { "type": "call", "pid": 5932, "cid": 2117 }, { "type": "call", "pid": 5932, "cid": 2118 }, { "type": "call", "pid": 5932, "cid": 2119 }, { "type": "call", "pid": 5932, "cid": 2120 }, { "type": "call", "pid": 5932, "cid": 2121 }, { "type": "call", "pid": 5932, "cid": 2122 }, { "type": "call", "pid": 5932, "cid": 2123 }, { "type": "call", "pid": 5932, "cid": 2124 }, { "type": "call", "pid": 5932, "cid": 8233 }, { "type": "call", "pid": 5932, "cid": 8234 }, { "type": "call", "pid": 5932, "cid": 8235 }, { "type": "call", "pid": 5932, "cid": 8236 }, { "type": "call", "pid": 5932, "cid": 8237 }, { "unhook": "function_name: CryptHashSessionKey, type: restored" }, { "unhook": "function_name: CryptGenRandom, type: restored" }, { "unhook": "function_name: CryptExportKey, type: restored" }, { "unhook": "function_name: NCryptImportKey, type: restored" }, { "unhook": "function_name: CryptGenKey, type: restored" }, { "unhook": "function_name: CommandLineToArgvW, type: restored" }, { "unhook": "function_name: CryptAcquireContextW, type: restored" }, { "unhook": "function_name: CryptAcquireContextA, type: restored" }, { "unhook": "function_name: SslEncryptPacket, type: restored" }, { "unhook": "function_name: CryptEncrypt, type: restored" }, { "unhook": "function_name: CryptEnumProvidersA, type: restored" }, { "unhook": "function_name: CryptHashData, type: restored" }, { "unhook": "function_name: SslDecryptPacket, type: restored" }, { "unhook": "function_name: CryptCreateHash, type: restored" }, { "unhook": "function_name: CryptEnumProvidersW, type: restored" }, { "unhook": "function_name: NCryptDecrypt, type: restored" }, { "unhook": "function_name: NCryptEncrypt, type: restored" }, { "unhook": "function_name: CryptDecrypt, type: restored" }, { "unhook": "function_name: CryptImportKey, type: restored" } ], "new_data": [], "alert": false, "families": [] }, { "name": "hardware_id_profiling", "description": "Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keying", "categories": [ "evasion", "recon", "anti-sandbox" ], "severity": 3, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 3850 }, { "type": "call", "pid": 5932, "cid": 5267 }, { "type": "call", "pid": 5932, "cid": 5268 }, { "type": "call", "pid": 5932, "cid": 5601 }, { "type": "call", "pid": 5932, "cid": 5839 }, { "type": "call", "pid": 5932, "cid": 5840 }, { "type": "call", "pid": 5932, "cid": 7357 }, { "type": "call", "pid": 5932, "cid": 7358 }, { "type": "call", "pid": 5932, "cid": 8434 }, { "type": "call", "pid": 5932, "cid": 8435 } ], "new_data": [], "alert": false, "families": [] }, { "name": "antivm_generic_system", "description": "Checks the system manufacturer, likely for anti-virtualization", "categories": [ "anti-vm" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [], "new_data": [ { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 5932 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] }, { "process": { "process_name": "MicrosoftEdgeUpdate.exe", "process_id": 11132 }, "signs": [ { "type": "registry", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer" } ] } ], "alert": false, "families": [] }, { "name": "suspicious_iocontrol_codes", "description": "Uses suspicious IO control codes, indicative of disk enumeration or a bootkit/wiper", "categories": [ "bootkit", "rootkit", "wiper" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 5932, "cid": 5267 }, { "type": "call", "pid": 5932, "cid": 5268 }, { "type": "call", "pid": 5932, "cid": 5839 }, { "type": "call", "pid": 5932, "cid": 5840 }, { "type": "call", "pid": 5932, "cid": 7357 }, { "type": "call", "pid": 5932, "cid": 7358 }, { "type": "call", "pid": 5932, "cid": 8434 }, { "type": "call", "pid": 5932, "cid": 8435 } ], "new_data": [], "alert": false, "families": [] }, { "name": "interprocess_comms_mutex", "description": "Inter-process synchronization via mutexes, possibly for routing local C2 traffic or injection", "categories": [ "lateral_movement", "c2", "ipc", "stealth" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 11132, "cid": 370 }, { "type": "call", "pid": 11132, "cid": 684 }, { "type": "call", "pid": 11132, "cid": 1636 }, { "type": "call", "pid": 11132, "cid": 2899 }, { "ipc_mutex_synchronization": [ { "mutex_name": "__OMADM_NAMED_MUTEX__", "creator_process": "MicrosoftEdgeUpdate.exe (PID: 5932)", "accessor_process": "MicrosoftEdgeUpdate.exe (PID: 11132)" }, { "mutex_name": "_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log", "creator_process": "MicrosoftEdgeUpdate.exe (PID: 5932)", "accessor_process": "MicrosoftEdgeUpdate.exe (PID: 11132)" }, { "mutex_name": "Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}", "creator_process": "MicrosoftEdgeUpdate.exe (PID: 5932)", "accessor_process": "MicrosoftEdgeUpdate.exe (PID: 11132)" }, { "mutex_name": "Global\\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}", "creator_process": "MicrosoftEdgeUpdate.exe (PID: 5932)", "accessor_process": "MicrosoftEdgeUpdate.exe (PID: 11132)" } ] } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_childproc", "description": "Forces a created process to be the child of an unrelated process", "categories": [ "stealth" ], "severity": 3, "weight": 1, "confidence": 100, "references": [ "https://www.countercept.com/blog/detecting-parent-pid-spoofing/" ], "data": [ { "created_process": "Process C:\\Windows\\system32\\WerFault.exe -u -p 8756 -s 284 has spoofed parent process with real parent process svchost.exe" }, { "type": "call", "pid": 9388, "cid": 2006 } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 10.0, "ttps": [ { "signature": "antisandbox_unhook", "ttps": [ "T1562.001", "T1562" ], "mbcs": [ "OB0001", "B0003", "OB0006", "F0004", "F0004.003" ] }, { "signature": "hardware_id_profiling", "ttps": [ "T1082" ], "mbcs": [ "E1082", "E1480.001" ] }, { "signature": "antivm_generic_system", "ttps": [ "T1012", "T1057", "T1082", "T1497" ], "mbcs": [ "OB0001", "B0009", "B0009.005", "OB0007", "E1082", "OC0008", "C0036", "C0036.005" ] }, { "signature": "antivm_checks_available_memory", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "suspicious_iocontrol_codes", "ttps": [ "T1542.003" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "privilege_elevation_check", "ttps": [ "T1033", "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "query_fips_reconnaissance", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "dead_connect", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "mountpoints_volume_discovery", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "dllload_suspicious_directory", "ttps": [ "T1574" ], "mbcs": [ "F0015" ] }, { "signature": "registers_vectored_exception_handler", "ttps": [ "T1055", "T1574" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "creates_suspended_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "resumethread_remote_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "stealth_childproc", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "terminates_remote_process", "ttps": [ "T1071" ], "mbcs": [ "C0018" ] }, { "signature": "accesses_public_folder", "ttps": [ "T1548", "T1036" ], "mbcs": [] }, { "signature": "discover_registry_mount_points", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "suspicious_tld", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "uses_windows_utilities", "ttps": [ "T1202" ], "mbcs": [ "OB0009", "E1203.m06" ] } ], "malstatus": "Malicious" }